I’m reading the words ”data breach” a lot in the Facebook Cambridge Analytica scandal context (example). But is this a correct way to describe the scandal?
The definition of data breach from the corresponding Wikipedia page is:
A data breach is the intentional or unintentional release of secure or private/confidential information to an untrusted environment.
The definition of ”data breach” in 38 U.S. Code § 5727 (4) is:
The term “data breach” means the loss, theft, or other unauthorized access, other than those incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data.
Two questions about this;
- The first question is around the word: (un)intentionally. In the case of Facebook, the data was intentionally shared with third-party developers. Meaning that it would be a data breach following the Wikipedia definition but not following the definition as mentioned in 38 U.S. Code § 5727 (4). Which definition should be followed?
- What would be the implications for Facebook if this is or isn’t a data breach?