[nolok]

In EU law too. Booking.com just got convicted half a million just for notifying TOO LATE (two weeks after the fact).

I assume they expect to claim it's not a fb leak in some convoluted way, otherwise I don't understand that move.

Oh wait, weren't there also shadow numbers in this ? Aka you had my number you uploaded it so it's in the leak even though I had no relation to them ? Might be why, they have no right to contact me to warn me

[pmlnr]

Yeah, but the b.com leak involved credit card data which changes everything in the eyes of regulators. Sadly this is not true for "mundane" data like phone numbers, email addresses, or even physical addresses.

[sofixa]

In regards to GDPR, personally identifiable information is the main focus.