I live in some EU country and I rely on social security provided by the regional government. There is a website for residents who can sign up and claim benefits without physically visiting an office. While helping a friend sign up, I accidentally discovered critical bugs that could enable anyone visiting the website to run arbitrary code. I documented my findings and sent them via email. I received an automated response that said my email was received but didn't hear any further.

To protect my data I disabled my account and asked all data to be removed from the website. I started walking half an hour to the office and doing everything on paper to receive my benefits. However after months, the exploit seems to have not been fixed yet. I am deeply concerned that a malicious actor could have already accessed the data and made the lives of the most vulnerable of our society even more vulnerable. Since the interface feels more than a decade old which suggests the back-end also is, this is a real possibility. Does GDPR mandate that institutions fix bad code that could compromise security and/or privacy of its users? If not is there any other legislation that I can cite to pressure them to fix their site? If I were outside the EU, what legislation would do the job?

  • The word "exploit" is not being using in its plain and non-technical sense in this question. Is there another word which could be used which would be more clear?
    – ohwilleke
    Aug 29, 2023 at 19:05
  • 1
    @ohwilleke "security breach" is an approximate equivalent. I am not sure the OP is using the technical jargon correctly anyway - this looks like a vulnerability (the door to the warehouse is left open and unguarded) rather than an exploit (someone went through the open door, took stuff, and ran away). The OP has identified a vulnerability, but they did not use it in a practical manner.
    – KFK
    Sep 5, 2023 at 13:01

1 Answer 1


No, but the organisation can be fined if they don't

Assuming the local government is a data controller, Article 24 requires that they:

  • Take into account the purpose, nature, context, and scope of any data processing activities.
  • Consider the likelihood of any severe risk to the freedoms and rights of any natural persons.
  • Implement appropriate organizational and technical measures and security measures that demonstrate that the data processing activities have been performed in accordance with GDPR regulation.
  • Review and update these measures where necessary.

Having a portal where a potential exploit can expose personal data to a hacker does not satisfy the bolded point.

Feel free to report them to your country's regulator.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .