3

I have an online account with the Company "A". On that account my PayPal account is linked.

A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not huge, thank god). I checked the transactions info and it was through PayPal, and Company "A" was listed under PayPal's Transaction details. I contacted that company, I explained what happen and soon they refunded the amount.

Then I asked them to explain me what happened but they refuse to answer. As a consumer do I have the legal right for an explanation? How the GDPR can enforce my legal rights on that case?

I totally understand that they refunded the amount but, in nowadays they should be more sensitive with cases like these.

Improve this question
2
  • I am not sure what rights to an explanation, if any, the GDPR grants. But there are legit reasons why Company A may not want to provide details. 1) They may not (yet) know just how someone got false info into their system. 2) They may know very well, but not want to make the method public, lest others use it in scams of their own. Just what sort of explanation are you hoping for, after all?
    – David Siegel
    Jan 16, 2019 at 23:14
  • Hi David, Thanks for your reply. It is a fact that this has occurred again to others and not just recently. The explanation I am hoping is to let me know if some of my actions resulted to this or just take the blame. Just to let you know they accused that my email has been compromised which is not true, cause I am using GSuite with 2FA. If that's the case then we are talking for a big issue for Google. After I mentioned that they never mentioned my email again Due to the fact, that this keeps happening they should resolve this issue asap or restrict the usage of that service on their website.
    – Bobbys
    Jan 17, 2019 at 7:47

2 Answers 2

Reset to default
1

Unauthorised access to your account, which granted access to personal data, would have constituted a data breach under GDPR. The obligations incumbent upon the controller (Company A) may include informing their supervisory authority and/or the data subject (you) once they became aware of the breach. When you reported it, and they received that report, the clock started.

Under the GDPR you have the right to request access to personal data held about you, which should include data about the fact - or not - of a data breach. You can also specifically ask whether there was a report, a data breach, whether the supervisory authority as informed, and what data if any was accessed. If they have such records and are aware, they must provide it to you except where that would violate the privacy of another living human being (natural person).

You could also find out which is their lead supervisory authority and ask them what to do in this specific case.

Improve this answer
0

From what I read, it sounds like Company A made a mistake, and rectified it within a reasonable time of being made aware of it.

Fraud would imply intent to permanently deprive you of your funds. It looks like Company A has shown no such intent, and has demonstrated the opposite by providing a refund.

It seems the company was processing your personal data as part of [what they believed to be] an ongoing contract, which is a lawful basis for processing under GDPR.

On the evidence at time of posting, there does not appear to have been a breach of the security of your Personal Data by Company A.

Improve this answer
2
  • Thanks for your reply. I forgot to mention that, someone breached my account. I had no contract with them or what so ever.
    – Bobbys
    Jan 16, 2019 at 14:39
  • Ah. Apologies - I responded to the word "breach" in the title and guessed (wrongly) you were referring to Company A. Editing.
    – ItWasLikeThatWhenIGotHere
    Jan 16, 2019 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .