Black Hat: GDPR privacy law exploited to reveal personal data

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by gowld on Friday August 09, 2019 @12:49PM (#20656064)

I doubt that a black-hat attacker is going to file a lawsuit to obtain someone else's personal information.

[ Parent | on HN ]

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by red_trumpet on Friday August 09, 2019 @01:08PM (#20656268)

But what if the request is genuine?

[ Parent | on HN ]

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by tremon on Friday August 09, 2019 @01:29PM (#20656491)

Then the user will be authenticated by the court, and you will have to make your case that without the court's intervention, you could not be certain of the requester's identity.

This isn't black and white. It is legally ok to question the validity of GDPR data subject requests.

[ Parent | on HN ]

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by JumpCrisscross on Friday August 09, 2019 @12:55PM (#20656141)

> I doubt that a black-hat attacker is going to file a lawsuit

If you tell someone requesting their own data under GDPR “tough luck, you lost your password,” that could invite remedies under the law.

[ Parent | on HN ]

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by Semaphor on Friday August 09, 2019 @04:06PM (#20657838)

What are they going to sue for? "I can’t identify myself but still want the data of some random person I claim to be"?

[ Parent | on HN ]