Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I used to work for a company, where they have a team of moderators, who actively monitor which accounts are scammers etc. To monitor this they can find links between user accounts via a users password, so they are able to see all user passwords in plain text.
Is this breaking any law or is it more just morally run?
The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “[t]aking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons” (c.f. Art 24, 25, 32 GDPR).
As of 2021, the state of the art for password storage is a special password hashing function such as Argon2, bcrypt, or scrypt.
However, the nature and context of processing could reasonably lead to the conclusion that the usual hashed password storage is not appropriate, for example because the ability to find links between user accounts is more important. There is a trade-off between different aspects of security, and the data controller could reasonably arrive at an unusual conclusion. However:
The data controller would still have to implement appropriate measures to protect these plaintext passwords, for example by storing them in an encrypted manner, keeping unforgeable access logs, and limiting access to plaintext passwords to specially trained staff. Encryption is one of the few things that are explicitly required whenever appropriate.
The data controller better have a good analysis that shows that this unusual approach to security is appropriate. Even if not explicitly required, an Art 35 data protection impact assessment could be useful. The data controller has the burden of proof to show that these processing activities are GDPR-compliant.
So is this data controller breaking the law or doing morally dubious stuff? Not necessarily! It is possible to find a scenario where they are doing the right thing. However, such a scenario is far-fetched and rather unlikely. Without further background, the most likely explanation is that the presented password handling scheme does not comply with GDPR.
GDPR regulations on the whole do not actually mention passwords (source: Information Commissioner's Office UK, this may vary in other country's implementation of GDPR) and providing that the data is only accessible by authorised parties within the organisation within the parameters set out in user agreements and/or privacy policies, then the law isn't broken.
That being said, if the passwords are stored in plain text then that's a security flaw and should the data be leaked, the entire user base would have grounds for a civil suit against the organisation.
