News for hackers. Stuff that matters.

A comment on The personal info of what could be Instacart customers is being sold online. Parent comment

Re:The personal info of what could be Instacart customers is... by caoilte on Thursday July 23, 2020 @06:21AM (#23925834)
I'm not sure that's a violation of GDPR. If person A has accidentally authorised their personal correspondence to be sent to person B they are pretty culpable for the consequence. Good systems require you to verify your email address, but I'm not sure there's a legal requirement to enforce that.

Regardless, it's a very different problem to a bug introduced by the company that leaks customer information.

[ Parent | on HN ]
Re:The personal info of what could be Instacart customers is... by richrichardsson on Thursday July 23, 2020 @06:30AM (#23925887)
> I'm not sure that's a violation of GDPR.

I think the initial communication is obviously not the fault of the company, but as soon as they are aware and refuse to put right the situation, I think they are very much at fault.

[ Parent | on HN ]
Re:The personal info of what could be Instacart customers is... by icu on Thursday July 23, 2020 @09:48AM (#23927320)
Exactly, honest mistakes can, and do, happen. The cause should be investigated and if minor, logged on a register; if serious, it must be reported to the regulator.
[ Parent | on HN ]
Re:The personal info of what could be Instacart customers is... by richrichardsson on Thursday July 23, 2020 @04:03PM (#23931657)
The initial email was pretty bad, I immediately deleted it and contacted them, but it included:

- Full name

- Date of Birth

- Some kind of National ID number

- Bank account details

- Address

If I was of a lesser moral character I'm sure I could have been very naughty with that information.

[ Parent | on HN ]
Re:The personal info of what could be Instacart customers is... by hnick on Thursday July 23, 2020 @07:04AM (#23926060)
Another possibility is the email address is read out (such as over the phone) and a staff member transcribes it incorrectly.
[ Parent | on HN ]
Re:The personal info of what could be Instacart customers is... by lmkg on Thursday July 23, 2020 @10:31AM (#23927721)
GDPR has a requirement that data be accurate (Article 5, section 1 d). This is applicable in practice because of the Right to Rectification, Article 16.

https://gdpr-info.eu/art-16-gdpr/

The initial issue is probably not a violation of GDPR, and not a reportable data breach. However, not fixing the issue after it was brought to their attention is more likely to be a violation.

[ Parent | on HN ]
Re:The personal info of what could be Instacart customers is... by icu on Thursday July 23, 2020 @09:40AM (#23927249)
It's definitely a GDPR breach, but it may not necessarily be reportable to the data regulator. Imho it should definitely be reported to the data protection officer first before going to the regulator. Most frontline staff have no idea how to handle GDPR queries or issues, but it's the designated data protection officer's role to be responsible.
[ Parent | on HN ]