I was listening to a podcast just yesterday on this, about the TalkTalk data breaches. Dido Harding used this distinction in the parliamentary committee and I think she was correct but it really sounded like she was trying to wriggle off the hook.