How GDPR caused the leakage of personal data

According to the GDPR, EU citizens have the right to request a copy of their personal data stored on the servers of a company. It has recently become known that this mechanism can be used to collect another person's PD. One of the participants in the Black Hat Conference conducted an experiment during which he obtained archives containing his bride's personal data from various companies. He has sent appropriate requests on her behalf to 150 organizations. Interestingly, 24% of companies had enough email and phone numbers as IDs - after receiving them, they returned the file archives. Another 16% of organizations additionally requested passport photos (or other document).

As a result, James was able to obtain a social security number and credit card, date of birth, maiden name and address of his "victim". One service to check if an email address is "lit up" in any source (such as Have i been pwned?) Even sent a list of previously used authentication data. This information can be hacked if the user has not changed their passwords or used them somewhere else.

There are other examples where the data was discovered in the wrong hands after a "false" submission. Yes, three months ago, one Reddit user requested personal information about himself from Epic Games. However, she mistakenly sent his PD to another player. A similar story happened last year. An Amazon client accidentally received a 100-megabyte archive of Internet requests to Alexa and thousands of other user's WAF files.

One of the main reasons for such situations is the incompleteness of the General Data Protection Regulation. In particular, the GDPR specifies the timeframe within which a company must respond to customer requests (within a month) and specifies penalties of up to € 20 million, or 4% of annual revenue, for failing to comply with this requirement. However, the very procedures that should help companies comply with the law (for example, make sure that the data is sent to their owner) are not specified. Therefore, organizations have to build their own workflows (sometimes by trial and error).

One of the most radical proposals is to give up GDPR or radically revise it. It is believed that the current law does not work, as it is very complex and excessively harsh, and to meet all its requirements have to spend a large amount of money.

For example, last year the developers of the game Super Monday Night Combat were forced to turn down their project. According to its creators, the budget needed to recycle systems under GDPR exceeded the budget allocated to the seven-year game.