Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

New answers tagged

0

Let me start by saying based on your posted information it is a breach of GDPR. Well, do not take this wrong, yet to answer your question I have to play the "devil's advocate" role. 1st, machine learning = automated processing (meaning the Data Subject must be informed and be entitled to opt-out) then "... predicting mortality rates (...) of, for example, ...


0

The GDPR defines personal data as any information related to a natural person (data subject) that can be used to directly or indirectly identify that person. So I would think you are ok it that respect, question is "insuretech" allowed to pass the information on to you in the first place, it would depend on how they stated how the data would be used when ...


1

By default, both the school and the SaaS provider are Controllers. However, the SaaS provider is likely eligible to act as a Processor in this relationship. Processor status is not automatic but requires a DPA to be signed. A provider might insist on Processor status because it simplifies their compliance, or might refuse this status because they lose ...


2

Under GDPR the Controller is the party which has defined "purpose" and "scope", meaning what the Processor is supposed to do while Processing Personal Data within the scope of a Service being rendered by the Controller. So, if the Controller has defined what the Software does and the other company has developed the software "tailor-made" as per the ...


2

It's possible that they're storing a hash of the entire password, and in addition storing a hash of just characters 4-5. If they always ask for the same two characters when you call in, this is more likely. The 4-5 hash is a small security vulnerability, since it would be much easier to crack than full passwords, and then that can be used to reduce the ...


1

Focusing on the actual problem, your ISP needs to have a way to authenticate its customers (a 'password') when they phone customer support. This means that such password needs to be told to the support agent. Of course, it would be a bad idea to tell them your password, so apparently they decided to setup their system such as: Store the password unhashed ...


14

Well, you may be right (probably), yet then again, you may be wrong... As David Siegel mentioned, they may have encrypted the password and have authorized support personal decrypting them up-on support calls for authentication purposes... What you can do is to submit a Data Subject Access Request focused on your Password and HOW they handle it in a secure ...


29

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient if properly implemented (strong hash function, use of salt, etc). But other methods of securing the password might be sufficient. Encrypting the PW rather ...


1

I would start by enquiring as to WHICH Personal Data they have about you and if any was obtained via "Track and Tracing" (RFID). If the answer is YES, I would further inquire about the Lawful Base (since, and assuming you have not Consent to it), plus processing "purpose" and "scope". If they argue Legitimate Interest, you can request the performed Impact ...


0

You can ask for the data, but the data controller would probably refuse on the ground that it might not have been you carrying the key at the time, and he cannot disclose data possibly relating to another person. You can ask for the data to be destroyed, but the same argument might apply - that the retained data does not relate to you, but relates to ...


1

There is some lawful controversy as to whether obtaining data on a webserver is simply accessing public information on the web or whether it was through "hacking". A savvy computer user might be able to access a lot of files on a webserver that was not intended to be accessed by the server admins. Is finding access to these files a form of illegal hacking or ...


0

Assuming you're in the United States, I think Patrick87 has provided good advice from a practical and ethical perspective. As a legal matter, though, I don't believe any of his caveats or necessary. You have no "duty of care" as a result of your discovery, and it would probably be legal to do just about whatever you wanted with the database. You obtained ...


1

The DPO has the responsibility for GDPR Compliance (not liability, nor even accountability in the sense that the Company is accountable, unless the DPO "basically screwed up"). No DPO is expected to be Superman/ Woman, training people on his/ her own; knowing Legal affairs; IT; Corporate Operation; ... The DPO is expected to ensure having the necessary "...


1

According to a principle of segregation of duties, that is implied in every controlling activity in corporate environment, it is undesirable to combine monitoring (as the Article states prescribes a direct duty) and operational execution functions (training as a process of implementation) in one position, i.e. DPO. Especially, taking into account DPO's high ...


1

In Romania, within our national law, the DPO has to do the training regarding data protection. This trainings should be performed within other trainings, where you tell the them some examples to understand the importance of data protection.


3

As a native English speaker I would read this as requiring the DPO to monitor all the things listed (i.e. you are correct). Furthermore it would be ridiculous for the DPO to be personally responsible for doing all of these things. If you were supposed to perform "assignment of responsibilities" yourself that would pretty much make you the Chief Operations ...


Top 50 recent answers are included