I believe to know that an employee at a company that I'm customer at, I believe has accessed my customer profile and gotten personal information, such as my full name, ID number and address. I know that I have the right to know all data on my profile that the company reserves. That includes logs. Can I get some advice on what exactly I should do?

  • Were they accessing this information in the course of their job, or do you believe it was accessed for malicious intent? When you say that you believe somebody accessed this and "what can I do?" what is your complaint? The GDPR protects your personal information, but if a company employee is using it for the course of business I don't see what the issue is. If you have some other concern, you'll need to outline that so we can suggest appropriate action...
    – Ron Beyer
    Jun 24 '19 at 18:13
  • It was accessed for malicious intent. Therefore he has no right to view my profile. He has personal info about me now. Jun 24 '19 at 18:25

Well if you are positive that an employee that had no business accessing your Personal Data did so and under a malicious perspective, that is, in fact, a Data Breach... Data Breaches also consist of unauthorized access (independently from internal or external sources).

So what you should do is:

1st - start by submitting a DSAR requesting that the company informs you about WHICH Personal Data they have that pertains to you, both source as well as derived from processing activities and WHAT Services "purpose" and "scope" support the existence of such Data that resulted from processing.

2nd - After getting the answer back (which should not take longer than 1 month, for you will not ask for the Data, yet Data types/ family; e.g. contact data) now two scenarios may apply: 2a - you have documented proof of foul play, then submit such evidence as enquiring about why did the company not detect the Data Breach? 2b - you do not have proof of foul play, inform the company about your suspicions and present a complaint asking for their feedback.

3rd - depending on the feedback and if there was a Data Breach, present a complaint towards the Supervisory Authority for the Company failed to detect the unlawful access. Access (either physical or logical) to any repositories while ensuring Security and Confidentiality/ Privacy must be supported by Logs that can and are audited, plus "triggers" that generate alerts if such Security standards are breached... so something was not in place or did not work.


Ask to see your data

GDPR gives you that right.

GDPR does not mean that businesses can’t hold personal data on you - it only requires them to have a lawful reason, to protect it, to allow you to correct it and to dispose of it when no longer needed. They are allowed to use it for a lawful purpose.

Not the answer you're looking for? Browse other questions tagged or ask your own question.