That may well be so. But that doesn't mean this is how you do it.

I draw the line at downloading data beyond what is required to prove there is an issue and I think you probably should cross that line only when you either have a contract with the company you are researching or if you have a lawyer that you pay that has signed off on what you are about to do. Anything less than that an - imnsho - you are playing the lottery.

Courts, especially in Germany, are typically not pleased if you take possession of the data.

For instance:

https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...

And quite a few others besides.

▲

akerl_ a day ago | parent [-]

This seems to make clear what several other commenters have been pointing to: this isn’t you relating absolute facts of law in the way you've been claiming. It’s you relating your personal ethical evaluation and your opinion about how the laws should be interpreted and followed.

▲

jacquesm a day ago | parent [-]

That, and 280 or so company reviews, conversations with compliance officers, CISOs, auditors, pentesters, lawyers and other people in the M&A space about how those companies deal with security issues, reports and what constitutes a potential breach and what does not.

As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.

▲

akerl_ a day ago | parent [-]

So I should expect a news post about Lovable owing GDPR fines for failure to disclose a breach any day now?

▲

jacquesm a day ago | parent [-]

Quite possibly. If you are a data subject affected by this affair you can contact your local DPA.

	▲	akerl_ 8 hours ago \| parent [-]
		And if I don’t see fines against Lovable and they don’t report this as a breach, it would seem to suggest that your stance across this post isn’t the degree of absolute fact you’ve presented it as?