>Apple did all the things you described in the first paragraph.

Wow, you are arguing here without even reading the article or understanding the reality!

Short resume for the lazy : Apple guys were working on creating the emails to inform the victims (stuff like send the emails in the correct language) but in the end they never sent the emails. So from your example, some guys knew they sold some food that had poison in it(somehow the bad guys were clever to sneak pass their guards and put poison in the cans), the guys were concerned and were ready to go and announce the victims that they might need to do some health checks. But then Timmy said "the poison is not that strong, let's wait and see , if nobody notices we do nothing , we don't want the people to know that our walls and guards are not as great as our PR and fanboys claim to be. That would mean that out best PR line `think about grandma` was a lye all along"

On the contrary, the complaint is that they did not. They specifically chose not to alert those affected.

But also... you do understand that we're talking about analogous but not identical laws here right? The context of this entire thread is laws that specifically require notifying people of data breaches, and not laws that require recalling bad food.