11 ms·

This is pretty appalling, really: "Overall, of the 83 firms known to have held data... 24% supplied personal information without verifying the requester's iden

by jfk13 7y ago

This is pretty appalling, really: "Overall, of the 83 firms known to have held data... 24% supplied personal information without verifying the requester's identity." Want someone else's personal data? No need to "hack into" any systems; just ask for it!

Silhouette 7y ago
This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security checks, that's one thing, but what if they don't or they claim to have forgotten their password etc? Even if someone were willing to send us "strong" ID, we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. At best, we could find an image of a passport/driving licence/whatever from that person's country and see if what they've sent us looks about right and matches any personal details we do have for the data subject. Our disturbing conclusion was that if someone did ever send us certain types of request in connection with certain accounts, there might be no action we could safely take to resolve the situation that would definitely be lawful. If we get scammed by fake ID then we're breaking the law. If we don't accept ID that is real and comply with the subject request, we're also breaking the law. Fortunately the affected services aren't doing anything particularly exciting or risky with personal data either, so it seems unlikely that any serious harm would come to anyone whatever happened in our case. However, the same basic issue surely affects many other data controllers/processors, and they won't necessarily be such unlikely targets as the research here shows. I haven't yet found any practical guidance from the regulators on what would be considered reasonable in this sort of situation.
- bsimpson 7y ago
  Government officials created an untenable law in the name of the technological boogey man?! </mild-shock>
  - AstralStorm 7y ago
    Not bogey. Misuse of personal days it's happening daily, but the law is not exactly super great. Better than nothing I suppose.
    - drusepth 7y ago
      I think whether the current implementation of GDPR is better than nothing is still up for debate. The intention is mostly good, but the execution leaves an immense amount to be desired (as evidenced by common threads like this) and disproportionately affects/burdens small businesses.
  - fixitfixit 7y ago
    Hey now. Mass surveillance, data breaches, and non-consensual data sale are absolutely issues, and will continue to be. This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. Maybe we wouldn’t have to deal with the GDPR if we treated data as a liability from the beginning.
    - Silhouette 7y ago
      This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. I agree there are real dangers, but I don't think blaming it entirely on the tech industry is fair. The financial services industry has been profiling as much as it could get away with forever. Government security services and the like obviously do this sort of thing as well. Modern technology has made these things easier and surely provides a generous source of additional data to both of the above groups, and targeted ads have created another not entirely welcome variation on the theme, but modern technology is hardly the original source of creepy data-hoarding behaviour.
- greatpatton 7y ago
  "but what if they don't or they claim to have forgotten their password etc?" How do you manage this kind of use case in your normal operation? Does it mean that if you cannot reset your password your account is locked forever? If not how is this process less valid to answer a GDPR request?
- inetknght 7y ago
  > we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. This sounds like one of the risks of doing international business. If you can't follow the laws then don't play.
  - dmix 7y ago
    OP sounds like he was trying hard to navigate and follow the law? The problem is he ended up finding no reasonable solution that both protected his users privacy while also following the rules, and was disturbed by the implications of it all considering it was supposed to protect them in the first place. Those are very valid criticisms. Simply dismissing everyone who shows concern about a law as mere law dodgers or foreign bad actors disinterested in following the local law is unhelpful and borderline anti-intellectual.
    - PeterisP 7y ago
      One of the intended goals of GDPR is to reduce the processing of personal data - not only that the companies should do it differently, but that at least half of the companies who currently have my data really shouldn't have it in the first place. It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data. Yes, it raises the barriers for entry in areas where that data is absolutely necessary. But it also makes companies think twice whether it's really necessary and worth it, and that's a good thing.
      - JumpCrisscross 7y ago
        > it also makes companies think twice whether it's really necessary and worth it The simple fact that someone has an account at a service can be private information. For anything requiring even a modicum of persistence, keeping these data is tough to avoid. I think most of HN agrees GDPR’s goals are good. It was just sloppily drafted, passed and implemented.
- phicoh 7y ago
  One option would be to evaluate if it would be safe to delete the data. In that case you could offer to delete the data. Countries typically have some expensive way to proof identity. So, delete or actually proof who you are. Of course, sending a message to, say, a know email address that to intent to do that helps avoiding angry customers. If you cannot delete the data because it is valuable to the customer, then just to offer the service you already have to figure out have to give people access to their accounts if they lost the password.
  - gowld 7y ago
    Offering to let attackers delete customer data is not a good solution.
  - drusepth 7y ago
    "Hi, I'd like to request all my user data under the username phicoh." --> "I've forgotten the password to my account; would you just delete it instead then?"
- JumpCrisscross 7y ago
  > Even if someone were willing to send us "strong" ID Amusing that legislation intended to improve privacy is normalising sending IDs to sites one doesn’t trust enough to keep one’s personal data.
- tjoff 7y ago
  The email used during registration is sufficient. If you don't have email then username+password. If they don't have that they don't get access to data. They need to be able to prove who they are and reasonably that is the same information that is used during registration. If password is lost then tough luck.
  - JumpCrisscross 7y ago
    > If password is lost then tough luck This is your personal opinion of how it should work, not GDPR.
    - gowld 7y ago
      I doubt that a black-hat attacker is going to file a lawsuit to obtain someone else's personal information.
      - JumpCrisscross 7y ago
        > I doubt that a black-hat attacker is going to file a lawsuit If you tell someone requesting their own data under GDPR “tough luck, you lost your password,” that could invite remedies under the law.
        Semaphor 7y ago
        What are they going to sue for? "I can’t identify myself but still want the data of some random person I claim to be"?
      - red_trumpet 7y ago
        But what if the request is genuine?
        tremon 7y ago
        Then the user will be authenticated by the court, and you will have to make your case that without the court's intervention, you could not be certain of the requester's identity. This isn't black and white. It is legally ok to question the validity of GDPR data subject requests.
- mytailorisrich 7y ago
  This is nothing new. People could make "subject access requests" before the GDPR, and you could charge up to £10 (in the UK) to reply. It's perfectly lawful to refuse to disclose anything until you have received reasonable evidence of the person's identity and payment (I don't know if you can still charge under the GDPR -- Edit: Apparently you may not charge for the first copy, but you may for further copies). Considering the potential risks (including bad PR) and penalties it is better to refuse to disclose data because you have doubts rather than to disclose easily.
- gjvnq 7y ago
  I think I have a "legally safe", but slow, solution: 1. The user requests information about them but claims that they lost the password and the email address. 2. The company sends a form (in English) that basically asks for the information on the id (name, date of birth, etc) and the information being requested (ex: password reset). 3. The user prints this form, fills it out and attach a copy of their ID. 4. The user goes to a notary in their country to get the signature and ID verified. 5. The user sends the form to the client's country Ministry of Foreign Affairs to get the notary's signature verified. 6. The user sends the form to the embassy of the company's country to get the Ministry of Foreign Affairs seal/signature verified. 7. The user takes a picture of them holding the form and sends that picture via email or similar to the company. 8. The user sends the form via snail mail to the company. This process can be shortened if both the company's country and the client's country have ratified the Apostille Convention, formally known as the Hague Convention Abolishing the Requirement of Legalisation for Foreign Public Documents.
  - Matticus_Rex 7y ago
    Nope, that's not legally safe -- we've been told by data authorities that the verification methods cannot be "overly burdensome" to the data subject. I live in dread of subject access requests (and thankfully have only had one, and it happened to be really easy to verify).
    - bchanudet 7y ago
      IIRC they also allow charging the person - for a "reasonable" amount - for the data retrieval process (which I assume would include the "identity verification" part). Maybe using the 3-D Secure protocol (especially the second revision) would be enough to unburden yourself for verifying the identity as Mastercard/Visa/American Express supposedly check it for you. This would work only in some conditions (the data subject should have a card to their name that supports 3-D Secure protocol, and you need to had a complete payment platform to your website/app/whatever) and doesn't solve all the other problems we have (like being sure we are delivering the right information esp. regarding homonyms and so on), but that could be something to investigate.
- tremon 7y ago
  I'm not sure it should be this hard. If all you know about a customer is his e-mail address and site password, then you can only verify the user's identity by e-mail address and password. A "strong" ID only helps if you have prior information about that ID stored on your end. Likewise, it stands to reason that you shouldn't provide information about a user at e-mail request only, without proof that said user also knows the password to your site. You could even create a policy that a user cannot do GDPR requests for up to seven days following a e-mail password reset action, to mitigate the account hijack situation. As for data processors, who have no direct relationship with end users, the safest policy is to not collect personally-identifying information at all, only use the data controller's surrogate identity. And if you must collect PII, then use that previously stored data to verify the user, not an ID card that you have no way of validating. If you only have the natural address of the user (for example, you're a shipping company), then only offer to send the data to that known address, or make the user prove his residence (e.g. utility bills); if you only know a bank account number, ask for a (sufficiently-redacted) bank statement to that effect, etc. A government-issued ID is only worth asking for if you can verify it.
- yrro 7y ago
  > If we get scammed by fake ID then we're breaking the law. The person who committed fraud by providing a fake ID is breaking the law. I'd think that a regulator would take into account when deciding whether it would be in the public interest to prosecute you.
segmondy 7y ago
Verifying identity is a very hard problem.
- inxdz 7y ago
  That should not lead to an "open by default" policy.
  - mlindner 7y ago
    Maybe European regulators should have considered that before writing this law.
    - Avamander 7y ago
      They did by writing the eIDAS regulation.
  - deleted 7y ago
    [deleted]
- noxToken 7y ago
  Understood, but: So, when one train operator asked for a photocopy of a passport, he convinced it instead to accept a postmarked envelope addressed to the "victim". A postmarked envelope? This is baffling to me.
  - Theodores 7y ago
    The art of social engineering. The person doing this was a dab-hand at it or else they would not have done what they did. You can have a plausible excuse for not having your passport - left at parent's house or accidentally in storage. Driver's license - "I am a cyclist!" Electricity bill - "My housemate pays all the bills!" Bank statement - "I only do online banking!" Electoral roll? - "Don't vote!" But HR sent me a letter about an update to the company pension plan - will that do? Yes! - sends through postmarked envelope picture. By that stage the confidence trick has succeeded so 'we know the guy and he is legit'. You can get this far to get a mobile phone contract which counts as good as a utility bill in terms of supplementary proof of ID. This can then be used to get a deposit only bank account for 'savings'. This can then be just about enough ID to have almost created a person!!! But with GDPR social engineering you can have it all so much easier. There was so much panic about GDPR and purging every decent contact from the company newsletter list that no company thought through a thing about how to deal with GDPR information requests. Hubris at its finest.
paxys 7y ago
From a business’s perspective it's a lot worse to get sued for not complying with GDPR rather than for a side effect of complying with it.

by jfk13 7y ago

Silhouette 7y ago

This was actually one of the risks we identified when looking at GDPR for my own businesses last year. Given that in some cases all we have is an online account with minimal personal details, how can we possibly verify their identity to an acceptable standard if someone does send us a GDPR subject access request of any kind? If they have some sort of account with us already and that has associated ID and security checks, that's one thing, but what if they don't or they claim to have forgotten their password etc? Even if someone were willing to send us "strong" ID, we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. At best, we could find an image of a passport/driving licence/whatever from that person's country and see if what they've sent us looks about right and matches any personal details we do have for the data subject. Our disturbing conclusion was that if someone did ever send us certain types of request in connection with certain accounts, there might be no action we could safely take to resolve the situation that would definitely be lawful. If we get scammed by fake ID then we're breaking the law. If we don't accept ID that is real and comply with the subject request, we're also breaking the law. Fortunately the affected services aren't doing anything particularly exciting or risky with personal data either, so it seems unlikely that any serious harm would come to anyone whatever happened in our case. However, the same basic issue surely affects many other data controllers/processors, and they won't necessarily be such unlikely targets as the research here shows. I haven't yet found any practical guidance from the regulators on what would be considered reasonable in this sort of situation.

bsimpson 7y ago
Government officials created an untenable law in the name of the technological boogey man?! </mild-shock>
- AstralStorm 7y ago
  Not bogey. Misuse of personal days it's happening daily, but the law is not exactly super great. Better than nothing I suppose.
  - drusepth 7y ago
    I think whether the current implementation of GDPR is better than nothing is still up for debate. The intention is mostly good, but the execution leaves an immense amount to be desired (as evidenced by common threads like this) and disproportionately affects/burdens small businesses.
- fixitfixit 7y ago
  Hey now. Mass surveillance, data breaches, and non-consensual data sale are absolutely issues, and will continue to be. This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. Maybe we wouldn’t have to deal with the GDPR if we treated data as a liability from the beginning.
  - Silhouette 7y ago
    This isn’t a boogey man, this is real, and it’s entirely the technology industry’s fault. I agree there are real dangers, but I don't think blaming it entirely on the tech industry is fair. The financial services industry has been profiling as much as it could get away with forever. Government security services and the like obviously do this sort of thing as well. Modern technology has made these things easier and surely provides a generous source of additional data to both of the above groups, and targeted ads have created another not entirely welcome variation on the theme, but modern technology is hardly the original source of creepy data-hoarding behaviour.
greatpatton 7y ago
"but what if they don't or they claim to have forgotten their password etc?" How do you manage this kind of use case in your normal operation? Does it mean that if you cannot reset your password your account is locked forever? If not how is this process less valid to answer a GDPR request?
inetknght 7y ago
> we don't have any special knowledge of what official government-issued ID looks like in every country where we have customers, nor the human resources or automated technology to investigate in detail whether any ID that is sent might be faked. This sounds like one of the risks of doing international business. If you can't follow the laws then don't play.
- dmix 7y ago
  OP sounds like he was trying hard to navigate and follow the law? The problem is he ended up finding no reasonable solution that both protected his users privacy while also following the rules, and was disturbed by the implications of it all considering it was supposed to protect them in the first place. Those are very valid criticisms. Simply dismissing everyone who shows concern about a law as mere law dodgers or foreign bad actors disinterested in following the local law is unhelpful and borderline anti-intellectual.
  - PeterisP 7y ago
    One of the intended goals of GDPR is to reduce the processing of personal data - not only that the companies should do it differently, but that at least half of the companies who currently have my data really shouldn't have it in the first place. It depends on the circumstances of each scenario, but it would be completely reasonable if large numbers of smallish companies acknowledge that they lack the capacity to handle personal data properly and the recommended strategy for GDPR compliance is that they should simply stop requesting and storing that data. Yes, it raises the barriers for entry in areas where that data is absolutely necessary. But it also makes companies think twice whether it's really necessary and worth it, and that's a good thing.
    - JumpCrisscross 7y ago
      > it also makes companies think twice whether it's really necessary and worth it The simple fact that someone has an account at a service can be private information. For anything requiring even a modicum of persistence, keeping these data is tough to avoid. I think most of HN agrees GDPR’s goals are good. It was just sloppily drafted, passed and implemented.
phicoh 7y ago
One option would be to evaluate if it would be safe to delete the data. In that case you could offer to delete the data. Countries typically have some expensive way to proof identity. So, delete or actually proof who you are. Of course, sending a message to, say, a know email address that to intent to do that helps avoiding angry customers. If you cannot delete the data because it is valuable to the customer, then just to offer the service you already have to figure out have to give people access to their accounts if they lost the password.
- gowld 7y ago
  Offering to let attackers delete customer data is not a good solution.
- drusepth 7y ago
  "Hi, I'd like to request all my user data under the username phicoh." --> "I've forgotten the password to my account; would you just delete it instead then?"
JumpCrisscross 7y ago
> Even if someone were willing to send us "strong" ID Amusing that legislation intended to improve privacy is normalising sending IDs to sites one doesn’t trust enough to keep one’s personal data.
tjoff 7y ago
The email used during registration is sufficient. If you don't have email then username+password. If they don't have that they don't get access to data. They need to be able to prove who they are and reasonably that is the same information that is used during registration. If password is lost then tough luck.
- JumpCrisscross 7y ago
  > If password is lost then tough luck This is your personal opinion of how it should work, not GDPR.
  - gowld 7y ago
    I doubt that a black-hat attacker is going to file a lawsuit to obtain someone else's personal information.
    - JumpCrisscross 7y ago
      > I doubt that a black-hat attacker is going to file a lawsuit If you tell someone requesting their own data under GDPR “tough luck, you lost your password,” that could invite remedies under the law.
      - Semaphor 7y ago
        What are they going to sue for? "I can’t identify myself but still want the data of some random person I claim to be"?
    - red_trumpet 7y ago
      But what if the request is genuine?
      - tremon 7y ago
        Then the user will be authenticated by the court, and you will have to make your case that without the court's intervention, you could not be certain of the requester's identity. This isn't black and white. It is legally ok to question the validity of GDPR data subject requests.
mytailorisrich 7y ago
This is nothing new. People could make "subject access requests" before the GDPR, and you could charge up to £10 (in the UK) to reply. It's perfectly lawful to refuse to disclose anything until you have received reasonable evidence of the person's identity and payment (I don't know if you can still charge under the GDPR -- Edit: Apparently you may not charge for the first copy, but you may for further copies). Considering the potential risks (including bad PR) and penalties it is better to refuse to disclose data because you have doubts rather than to disclose easily.
gjvnq 7y ago
I think I have a "legally safe", but slow, solution: 1. The user requests information about them but claims that they lost the password and the email address. 2. The company sends a form (in English) that basically asks for the information on the id (name, date of birth, etc) and the information being requested (ex: password reset). 3. The user prints this form, fills it out and attach a copy of their ID. 4. The user goes to a notary in their country to get the signature and ID verified. 5. The user sends the form to the client's country Ministry of Foreign Affairs to get the notary's signature verified. 6. The user sends the form to the embassy of the company's country to get the Ministry of Foreign Affairs seal/signature verified. 7. The user takes a picture of them holding the form and sends that picture via email or similar to the company. 8. The user sends the form via snail mail to the company. This process can be shortened if both the company's country and the client's country have ratified the Apostille Convention, formally known as the Hague Convention Abolishing the Requirement of Legalisation for Foreign Public Documents.
- Matticus_Rex 7y ago
  Nope, that's not legally safe -- we've been told by data authorities that the verification methods cannot be "overly burdensome" to the data subject. I live in dread of subject access requests (and thankfully have only had one, and it happened to be really easy to verify).
  - bchanudet 7y ago
    IIRC they also allow charging the person - for a "reasonable" amount - for the data retrieval process (which I assume would include the "identity verification" part). Maybe using the 3-D Secure protocol (especially the second revision) would be enough to unburden yourself for verifying the identity as Mastercard/Visa/American Express supposedly check it for you. This would work only in some conditions (the data subject should have a card to their name that supports 3-D Secure protocol, and you need to had a complete payment platform to your website/app/whatever) and doesn't solve all the other problems we have (like being sure we are delivering the right information esp. regarding homonyms and so on), but that could be something to investigate.
tremon 7y ago
I'm not sure it should be this hard. If all you know about a customer is his e-mail address and site password, then you can only verify the user's identity by e-mail address and password. A "strong" ID only helps if you have prior information about that ID stored on your end. Likewise, it stands to reason that you shouldn't provide information about a user at e-mail request only, without proof that said user also knows the password to your site. You could even create a policy that a user cannot do GDPR requests for up to seven days following a e-mail password reset action, to mitigate the account hijack situation. As for data processors, who have no direct relationship with end users, the safest policy is to not collect personally-identifying information at all, only use the data controller's surrogate identity. And if you must collect PII, then use that previously stored data to verify the user, not an ID card that you have no way of validating. If you only have the natural address of the user (for example, you're a shipping company), then only offer to send the data to that known address, or make the user prove his residence (e.g. utility bills); if you only know a bank account number, ask for a (sufficiently-redacted) bank statement to that effect, etc. A government-issued ID is only worth asking for if you can verify it.
yrro 7y ago
> If we get scammed by fake ID then we're breaking the law. The person who committed fraud by providing a fake ID is breaking the law. I'd think that a regulator would take into account when deciding whether it would be in the public interest to prosecute you.

segmondy 7y ago

Verifying identity is a very hard problem.

inxdz 7y ago
That should not lead to an "open by default" policy.
- mlindner 7y ago
  Maybe European regulators should have considered that before writing this law.
  - Avamander 7y ago
    They did by writing the eIDAS regulation.
- deleted 7y ago
  [deleted]
noxToken 7y ago
Understood, but: So, when one train operator asked for a photocopy of a passport, he convinced it instead to accept a postmarked envelope addressed to the "victim". A postmarked envelope? This is baffling to me.
- Theodores 7y ago
  The art of social engineering. The person doing this was a dab-hand at it or else they would not have done what they did. You can have a plausible excuse for not having your passport - left at parent's house or accidentally in storage. Driver's license - "I am a cyclist!" Electricity bill - "My housemate pays all the bills!" Bank statement - "I only do online banking!" Electoral roll? - "Don't vote!" But HR sent me a letter about an update to the company pension plan - will that do? Yes! - sends through postmarked envelope picture. By that stage the confidence trick has succeeded so 'we know the guy and he is legit'. You can get this far to get a mobile phone contract which counts as good as a utility bill in terms of supplementary proof of ID. This can then be used to get a deposit only bank account for 'savings'. This can then be just about enough ID to have almost created a person!!! But with GDPR social engineering you can have it all so much easier. There was so much panic about GDPR and purging every decent contact from the company newsletter list that no company thought through a thing about how to deal with GDPR information requests. Hubris at its finest.

paxys 7y ago

From a business’s perspective it's a lot worse to get sued for not complying with GDPR rather than for a side effect of complying with it.