Re:Black Hat: GDPR privacy law exploited to reveal personal ...
by phicoh on Friday August 09, 2019 @11:29AM
(#20655247)
One option would be to evaluate if it would be safe to delete the data.
In that case you could offer to delete the data. Countries typically have some expensive way to proof identity. So, delete or actually proof who you are. Of course, sending a message to, say, a know email address that to intent to do that helps avoiding angry customers.
If you cannot delete the data because it is valuable to the customer, then just to offer the service you already have to figure out have to give people access to their accounts if they lost the password.
Re:Black Hat: GDPR privacy law exploited to reveal personal ...
by drusepth on Friday August 09, 2019 @06:43PM
(#20658805)
"Hi, I'd like to request all my user data under the username phicoh." --> "I've forgotten the password to my account; would you just delete it instead then?"
In that case you could offer to delete the data. Countries typically have some expensive way to proof identity. So, delete or actually proof who you are. Of course, sending a message to, say, a know email address that to intent to do that helps avoiding angry customers.
If you cannot delete the data because it is valuable to the customer, then just to offer the service you already have to figure out have to give people access to their accounts if they lost the password.