I think you missed that they only pulled the first page of paginated results. The opposite of exfiltration.
replyOf 10K+ tables...
replySo you're a legal expert now too? You characterization of what happened as "mass exfiltration" is just that - your personal opinion.
replyNo, OP documents that in painful detail.
replyhttps://gdpr-info.eu/art-4-gdpr/ section 12.
Under the GDPR this was a breach, pure and simple.
It's personal data breach for the controller (Lovable or the company that manages the app. Probably latter unless they are determined to joint controllers). It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).
replyOne thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.
> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).
replyGood luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.
The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.
"pure and simple" is again - YOUR interpretation. Sorry, but this is genuinely not interesting anymore. But thanks anyway for engaging. Good luck.
reply