4 ms·
The email used during registration is sufficient. If you don't have email then username+password. If they don't have that they don't get access to data. They n
by tjoff 7y ago
The email used during registration is sufficient. If you don't have email then username+password.
If they don't have that they don't get access to data. They need to be able to prove who they are and reasonably that is the same information that is used during registration.
If password is lost then tough luck.
- JumpCrisscross 7y ago> If password is lost then tough luck This is your personal opinion of how it should work, not GDPR.
- gowld 7y agoI doubt that a black-hat attacker is going to file a lawsuit to obtain someone else's personal information.
- JumpCrisscross 7y ago> I doubt that a black-hat attacker is going to file a lawsuit If you tell someone requesting their own data under GDPR “tough luck, you lost your password,” that could invite remedies under the law.
- Semaphor 7y agoWhat are they going to sue for? "I can’t identify myself but still want the data of some random person I claim to be"?
- red_trumpet 7y agoBut what if the request is genuine?
- tremon 7y agoThen the user will be authenticated by the court, and you will have to make your case that without the court's intervention, you could not be certain of the requester's identity. This isn't black and white. It is legally ok to question the validity of GDPR data subject requests.
- tjoff 7y agoGDPR requires the user to identify themselves to request data. If a password and username is the only possible way of identification then that is enough. And if one can not provide that then tough luck it is.