Are publicly available password dumps legal under GDPR

Question

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or personal data but it's quite common to see a text file with emails and passwords of the format:

[email protected]:abcdef
...
[email protected]:password123
[email protected]:hello456

This is useful information for security professionals to test if an account uses a password that's been published in a data leak somewhere. On the other hand, the data is stolen and the individuals have not consented to their data being used for this purpose.

There exist services such as Have I been pwned that allow a user to search these databases and find out if their data is included in a public data dump. Troy Hunt (who runs it) is based in Australia but if the site is available to users in Europe, it would still be covered by GDPR legislation. HIBP uses hashed passwords to maintain privacy.

Under GDPR, is it legal for me as an individual to hold a copy of a leaked database and is it legal for a security company to hold it (or information derived from it). I'm based in the UK (Scotland specifically) if other laws are relevant.

Answer 1

I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password.

It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier.

If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.

Answer 2

Under GDPR, is it legal for me as an individual to hold a copy of a leaked database and is it legal for a security company to hold it (or information derived from it).

It depends on whether the information is "personal data" as defined in Art. 4.

Email address itself is not personal data unless the owner can be identified. Password itself is neither. The combination of the two can be personal data if it can actually be used to log in and obtain more data showing who the owner is.

Answer 3

I've just found an answer to this in a document produced by a government CERT (CIRCL).

[T]he GDPR enables information exchange of personal data as long as it is performed for the purposes of ensuring network and information security or if it constitutes the legitimate interest of the data controller (e.g. preventing unauthorised access to sensible machine after credential leaks) (Recital 49). A processing activity should comply with the six principles in Art. 5, which could be summarized as: “lawfulness, fairness and transparency”, “purpose limitation”, “data minimisation”, “accuracy”, “storage limitation”.

In most cases when collecting, analysing and sharing information leaks, the information leaks come from stolen data, hence the processed personal data has not been obtained from the data subject. In this case, Art. 14 triggers the application of the transparency principle. This article requires that specific information, such as identity and contact details of the controller, is provided to the data subject. However, it can be difficult to provide such information to the information leak victims as the list can be very long. The GDPR has foreseen such use cases where consent may be difficult or impossible to obtain and provides some exceptions. Article 14(5)(b) is of particular relevance to AIL usage cases, as it states that Art. 14(1) to (4) shall not apply if “the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing”. This restriction needs however to be balanced with “appropriate measures” such as “making the information publicly available”. For example, CSIRTs could make information about their processing activities publicly available in line with RFC 2350 and GDPR Art.14(1) and (2).