Personal Information Leakage by Abusing the GDPR 'Right of Access'
summary
Researchers test 55 organizations across finance, retail, entertainment and news by sending GDPR right‑of‑access requests using forged or public data and simple social engineering. Verification steps asked include login, email ownership, ID photos and home address; adversaries use email spoofing and forged ID photos plus deadline pressure. Fifteen of 55 requests yield full or partial data, exposing transactions, delivery serials, GPS timestamps and browsing history. Recommendations include strict image ownership checks, callback to known numbers and avoiding photo IDs as sole proof.
AI-written summary · about
chapters (11)
- 0:00Intro
- 2:03Resource Questions
- 3:13How to Improve Identity Verification
- 3:54What Credentials are Being Asked
- 6:30Home address
- 6:57ID card
- 9:23Proof of identity
- 11:03Leaked Data
- 12:09Recommendations
- 13:46Ethics
- 14:24Questions
related talks
22mGDPArrrrr: Using Privacy Laws to Steal Identities
41mIllegitimate Data Protection Requests - To Delete or to Address?
52mDeveloping privacy
39mAccidental Abyss: Data Leakage on The Internet
48mThe impact of the GDPR
49mPractical privacy: GDPR explained
55mTechnical Consequences of the Data Subject's Rights #bbuzz
01h 00mHow I Met Your Data