4 ms·

Presumably it has to do with data subjects' right to request corrections to incorrect data.

rlpb 7y ago
That's why the companies had to respond, yes. But by responding with personal data without first verifying the identity of the requestor, they breached the GDPR by exposing that personal data.
- AnthonyMouse 7y ago
  So what are they supposed to do if they have no satisfactory way to verify your identity? They may have all kinds of information on you but not your passport number. Some people eligible to file requests may not even have a passport number. They may not even have your name (and multiple people share the same name anyway). Without any reasonable way to distinguish between legitimate requesters and attackers, their options are to not provide the information to someone who may be the right person or to provide it to someone who may be the wrong person. If both of those are illegal that implies it's impossible to comply with the law.
  - omnimus 7y ago
    What they are supposed to do is to set up their system so this problem does not exist. If you need identity data than verify identity. Most companies dont and then they should not store it. This is already the case in banking i dont see a reason why other companies think they shouldnt need to do this.
    - AnthonyMouse 7y ago
      > If you need identity data than verify identity. Most companies dont and then they should not store it. The problem is that there is data which is personally identifying and yet not useful to authenticate the user, and that information may be necessary for the operation of the service. > This is already the case in banking i dont see a reason why other companies think they shouldnt need to do this. What banks do is to know the identity of all their users. Requiring sites to do that is the exact opposite of the apparent purpose of this law, so it would be a massive farce if that was the only way to comply with it.
  - akadruid1 7y ago
    If you lack the means to comply with the law, you must not collect the data! The article also jumps to the same troubling conclusion: That the law is deficient because it failed to make provision for greedy data hoarders to continue without changing their business. In my opinion the law is working as intended, and requiring extreme security precautions around the hoarding of personal data. If a few companies with abusive business models become non-viable in the process, that's a side benefit
    - AnthonyMouse 7y ago
      Except that there are other laws requiring them to collect certain data, or it may be necessary for the operation of the service, so they can't just not collect it either.

rlpb 7y ago

That's why the companies had to respond, yes. But by responding with personal data without first verifying the identity of the requestor, they breached the GDPR by exposing that personal data.

AnthonyMouse 7y ago
So what are they supposed to do if they have no satisfactory way to verify your identity? They may have all kinds of information on you but not your passport number. Some people eligible to file requests may not even have a passport number. They may not even have your name (and multiple people share the same name anyway). Without any reasonable way to distinguish between legitimate requesters and attackers, their options are to not provide the information to someone who may be the right person or to provide it to someone who may be the wrong person. If both of those are illegal that implies it's impossible to comply with the law.
- omnimus 7y ago
  What they are supposed to do is to set up their system so this problem does not exist. If you need identity data than verify identity. Most companies dont and then they should not store it. This is already the case in banking i dont see a reason why other companies think they shouldnt need to do this.
  - AnthonyMouse 7y ago
    > If you need identity data than verify identity. Most companies dont and then they should not store it. The problem is that there is data which is personally identifying and yet not useful to authenticate the user, and that information may be necessary for the operation of the service. > This is already the case in banking i dont see a reason why other companies think they shouldnt need to do this. What banks do is to know the identity of all their users. Requiring sites to do that is the exact opposite of the apparent purpose of this law, so it would be a massive farce if that was the only way to comply with it.
- akadruid1 7y ago
  If you lack the means to comply with the law, you must not collect the data! The article also jumps to the same troubling conclusion: That the law is deficient because it failed to make provision for greedy data hoarders to continue without changing their business. In my opinion the law is working as intended, and requiring extreme security precautions around the hoarding of personal data. If a few companies with abusive business models become non-viable in the process, that's a side benefit
  - AnthonyMouse 7y ago
    Except that there are other laws requiring them to collect certain data, or it may be necessary for the operation of the service, so they can't just not collect it either.