1

Context:

  • I am working for an institution which has recently suffered a data breach.
  • There have also been articles in local press regarding the nature of the leaked data and claims about having access to extensive lists of breached data.
  • On discussions with my institution's law department, I was (at last) informed about my leaked personal data at a descriptive level, however, the response seems incomplete compared to what I would expect that would have been leaked and what is also mentioned in the press.
  • I am an EU resident working in an EU country, thus GDPR and any other relevant legislation apply here as well.

Question: Given the above, is it reasonable (and, furthermore, legally justified) to ask for a written confirmation of what personal data have not been leaked?

Improve this question
7
  • 2
    The problem is probably that you won't get a satisfying answer, as the company cannot know for certain.
    – PMF
    Jun 1 at 5:35
  • @PMF Yes, this is something I am also considering - it seems indeed infeasible to have a concrete answer on that in most cases. However, I am also considering issuing a complaint to my DPA and I would like to know whether such a request is also legally justify - e.g., within the context of GDPR, as it is the case with the rights to access, deletion etc.
    – Vassilis Markos
    Jun 1 at 5:38
  • 4
    I would assume the company doesn't know what exactly was and wasn't leaked. Of course it would be a lot nicer of them to just tell you that instead of claiming you were not affected but what are actually trying to achieve?
    – quarague
    Jun 1 at 14:09
  • It is reasonable to ask but they may not know what information was leaked and not leaked. It might be beyond their knowledge and ability to know what did or did not leak.
    – NCDC
    Jun 1 at 22:49
  • 1
    You can request all the data they hold, find out what has been leaked, and find the difference of the two? What kind of declaration are you wanting?
    – Stuart F
    Jun 2 at 15:45

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .