5

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or personal data but it's quite common to see a text file with emails and passwords of the format:

a.aaronson@aol.com:abcdef
...
johnsmith@hotmail.com:password123
johnsmith@gmail.com:hello456

This is useful information for security professionals to test if an account uses a password that's been published in a data leak somewhere. On the other hand, the data is stolen and the individuals have not consented to their data being used for this purpose.

There exist services such as Have I been pwned that allow a user to search these databases and find out if their data is included in a public data dump. Troy Hunt (who runs it) is based in Australia but if the site is available to users in Europe, it would still be covered by GDPR legislation. HIBP uses hashed passwords to maintain privacy.

Under GDPR, is it legal for me as an individual to hold a copy of a leaked database and is it legal for a security company to hold it (or information derived from it). I'm based in the UK (Scotland specifically) if other laws are relevant.

1

I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password.

It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier.

If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.

1

Under GDPR, is it legal for me as an individual to hold a copy of a leaked database and is it legal for a security company to hold it (or information derived from it).

It depends on whether the information is "personal data" as defined in Art. 4.

Email address itself is not personal data unless the owner can be identified. Password itself is neither. The combination of the two can be personal data if it can actually be used to log in and obtain more data showing who the owner is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.