News for hackers. Stuff that matters.

A comment on Black Hat: GDPR privacy law exploited to reveal personal data. Parent comment

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by JumpCrisscross on Friday August 09, 2019 @12:56PM (#20656153)
> Why would any random service request, process or more importantly store these?

So they can identify users for purposes of complying with GDPR? (For example, to handle the data requests highlighted in this post.)

[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by PeterisP on Friday August 09, 2019 @01:20PM (#20656395)
The GDPR recitals do not recommend gathering additional data solely to be able to fulfill these requests.

See https://gdpr-info.eu/recitals/no-64/ and https://gdpr-info.eu/recitals/no-57/ - the key part is "A controller should not retain personal data for the sole purpose of being able to react to potential requests."

[ Parent | on HN ]
Re:Black Hat: GDPR privacy law exploited to reveal personal ... by JumpCrisscross on Friday August 09, 2019 @03:21PM (#20657504)
> The GDPR recitals do not recommend gathering additional data solely to be able to fulfill these requests

One, these are non-binding recitals.

Two, the conflict between (a) data-furnishing requirements and (b) advice against retaining data that would validate the requestor is exactly the point of this post.

[ Parent | on HN ]