I believe to know that an employee at a company that I'm customer at, I believe has accessed my customer profile and gotten personal information, such as my full name, ID number and address. I know that I have the right to know all data on my profile that the company reserves. That includes logs. Can I get some advice on what exactly I should do?
closed as off-topic by A. K., Nij, mark b, Dale M, Tim Lymington Jul 2 at 16:22
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions that clearly ask for specific legal advice are off-topic. For more information, see Policy for questions that clearly ask for specific legal advice." – A. K., Nij, mark b, Tim Lymington
Well if you are positive that an employee that had no business accessing your Personal Data did so and under a malicious perspective, that is, in fact, a Data Breach... Data Breaches also consist of unauthorized access (independently from internal or external sources).
So what you should do is:
1st - start by submitting a DSAR requesting that the company informs you about WHICH Personal Data they have that pertains to you, both source as well as derived from processing activities and WHAT Services "purpose" and "scope" support the existence of such Data that resulted from processing.
2nd - After getting the answer back (which should not take longer than 1 month, for you will not ask for the Data, yet Data types/ family; e.g. contact data) now two scenarios may apply: 2a - you have documented proof of foul play, then submit such evidence as enquiring about why did the company not detect the Data Breach? 2b - you do not have proof of foul play, inform the company about your suspicions and present a complaint asking for their feedback.
3rd - depending on the feedback and if there was a Data Breach, present a complaint towards the Supervisory Authority for the Company failed to detect the unlawful access. Access (either physical or logical) to any repositories while ensuring Security and Confidentiality/ Privacy must be supported by Logs that can and are audited, plus "triggers" that generate alerts if such Security standards are breached... so something was not in place or did not work.
Ask to see your data
GDPR gives you that right.
GDPR does not mean that businesses can’t hold personal data on you - it only requires them to have a lawful reason, to protect it, to allow you to correct it and to dispose of it when no longer needed. They are allowed to use it for a lawful purpose.