Black Hat: GDPR privacy law exploited to reveal personal data

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by jefftk on Friday August 09, 2019 @01:09PM (#20656279)

If someone loses their password and asks for their data under the GDPR it's an open question whether the site can simply say "sorry, there's no longer any way for us to verify you are who you say you are".

[ Parent | on HN ]

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by PeterisP on Friday August 09, 2019 @01:56PM (#20656767)

Ah, that's actually simple - the answer depends on whether that statement is true or not.

In the abovementioned case where only name (which is not unique) and password and sexual orientation is stored, and literally nothing else, you can say "sorry, we took all reasonable measures to verify your identity, and couldn't" because that's how it is.

However, if google or paypal or someone else who stores much more data says "sorry, there's no longer any way for us to verify you are who you say you are", then that's a lie (easily verifiable by the regulator), and that's not acceptable.

[ Parent | on HN ]

Re:Black Hat: GDPR privacy law exploited to reveal personal ... by SiempreViernes on Friday August 09, 2019 @01:51PM (#20656712)

Is it? What paragraph makes it ambigious whether a company needs to do more than reasonable efforts establish if a request is legitimate?

[ Parent | on HN ]