When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or personal data but it's quite common to see a text file with emails and passwords of the format:
firstname.lastname@example.org:abcdef ... email@example.com:password123 firstname.lastname@example.org:hello456
This is useful information for security professionals to test if an account uses a password that's been published in a data leak somewhere. On the other hand, the data is stolen and the individuals have not consented to their data being used for this purpose.
There exist services such as Have I been pwned that allow a user to search these databases and find out if their data is included in a public data dump. Troy Hunt (who runs it) is based in Australia but if the site is available to users in Europe, it would still be covered by GDPR legislation. HIBP uses hashed passwords to maintain privacy.
Under GDPR, is it legal for me as an individual to hold a copy of a leaked database and is it legal for a security company to hold it (or information derived from it). I'm based in the UK (Scotland specifically) if other laws are relevant.