dark web hacker

In life there's always a catch-22, only in the case the General Data Protection Regulation (GDPR) it's more like an Article 23. The Right of Access established in the European Union's landmark privacy regulation allows consumers to request a copy of all the data that an organization has collected them.

But in doing so, the GDPR may have inadvertently made that same data more vulnerable to bad actors or identity thieves who surreptitiously take control of an EU citizen's account, and make the request on their behalf.  What's more, the GDPR doesn't make it easy for businesses to verify a consumer's true identity.

“It raises the stakes, that's for sure,” said Robert Braun, a partner at Jeffer Mangels Butler and Mitchell LLP.

By handing over data to a impersonator, companies could potentially be dealing with a double-edged sword — the ramifications of both a data breach and failure to adequately verify a consumer's identity. To make matters even more complicated, the GDPR doesn't specify what steps a company or an organization needs to take in order to ascertain the veracity of a request made under the Right to Access provision — just that steps have to be taken.

Braun said that many companies are falling back on whatever identity verification process they used to establish a consumer's account in the first place, but that those measures typically don't amount to much. In the event of a consumer's data being handed over to an imposter, the adequacy of a company's identify verification process would be viewed almost exclusively in hindsight.

“You'll have to defend what you did and that could be a challenge,” Braun said.

But while Right to Access presents a challenge, it may not be a complete game changer.

Jennifer Beckage, founder of the Beckage firm, doesn't think that hackers need take advantage of the GDPR in order to gain access to someone's personal information. If they want something, they'll figure out a way to get it.

“I've been practicing in this space for a really long time before data breaches were data breaches and impersonation and fraud have been around since the beginning of time. We're always going to see those things at play but the ability to access data is not entirely new,” Beckage said.

Potentially of more concern to businesses is the verification process itself, which runs the risk of violating the GDPR's data minimization principle. Article 23 of the regulations stipulates that organizations should collect or process only as much data as is necessary to complete a given task.

Imagine the last time you had to reset the password to your social media or online banking accounts. There's usually at least one pre-established question you to correctly answer in order to verify your identity, only this time it doesn't hinge on the name of somebody's first pet.

“[Companies] don't want to collect information more than what they already have or try to collect sensitive information that they may not need to authenticate,” Beckage said.

She suggests that companies consider the type of information that they are trafficking in when establishing an infrastructure to deal with Right to Access requests. A social security number may require more stringent verification procedures than an address.

“Rome wasn't built in a day and it's going to take time for organizations to find out what's working and not working and going through the assessment process and determining the best methods,” Beckage said.