Is an email enumeration vulnerability a breach of GDPR? I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows: User inputs their email If the email belongs to an existing user, report this via an error message. This might be on submitting the form or immediately as the user inputs the email. The issue here is that an (unauthenticated) user can use this to determine what emails are in use in the system. From a technical perspective there are ways to limit the damage (e.g. rate limiting) but my question is what the GDPR implications are of such a vulnerability, and what responsibility does the developer/company have to avoid this? I'm aware the emails are categorised as PII, which leads me to believe that it is an issue. However, it's also very common to see this flow in the wild. For context I'm based in the UK and work for a company operating in the UK and EU.
This is a good question, as it raises an issue which places the controller's interest in providing a smoothly functioning customer sign up process against customers' right not to have their data leaked. Note that it is not necessary to consider &quot;enumeration&quot; here. Even just being able to check whether one person has a registered account raises the issue. The relevant provisions of the EU GDPR (or in the UK, the UK GDPR as defined in sections 3(1) and 205(4) of the Data Protection Act 2018) are (emphasis added): Article 4(2): 'processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction So, disclosure of the fact that a user has a registered account amounts to &quot;processing&quot;. Article 6(1): Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Of these, only (a) and (f) are likely to be of any relevance: (a) is not too useful since it isn't feasible to design a sign-up system that depends on the user's consent (which they may not give). That leaves us with (f). As noted by the Information Commissioner's Office, &quot;Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.&quot;. The legitimate interest here would be that you need a sign up system which prevents duplicate registrations. Remember though that the processing has to be &quot;necessary&quot; for the purposes of the legitimate interest. One might argue that it is not since you could design the system to give the appearance of accepting the duplicate registration followed by sending an email to the account holder to inform them. On the other hand this will result in a less user friendly experience which could itself be a legitimate interest. Ultimately this is a balancing exercise and it is hard to say whether you have struck the right balance until someone complains to the ICO or the court and a decision is issued. The fact that the practice is widespread among well-resourced and large companies would tend to indicate that it is lawful albeit this is not conclusive in the absence of a court decision. I'm not aware of any cases involving this particular issue but would be interested to hear from others on this point. If the processing is unlawful then Article 18 is applicable: The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: [...] (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. In other words, the data subject could ask you not to disclose their registration status via the sign up page, and you would be obliged to comply with the request. Separately from the above points, in order to be lawful you must provide the data subject with certain prescribed information at the time when the data is collected. Of particular relevance here are the following items: Article 13(1): Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: [...] (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; So even if you conclude that the processing will be lawful you will have to give some consideration to the basis so that you can comply with the above provision.
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.
The intention of the GDPR is to minimize the amount of personally identifiable information (PII) you store. So the GDPR never tells you that you have to log certain events. The simplest way to make sure you comply with the GDPR is to simply not store any PII at all. But that might of course conflict with legitimate business interests and with other legal obligations you might have. So when you do store PII, then the GDPR regulates under which conditions you are allowed to store PII, for how long and what you are allowed to do with that PII. So when you receive a GDPR request from a customer to see their data, then you can say that you only have that one timestamp of their registration, because you didn't log their subsequent logins (assuming this is the truth). I hope your privacy policy says that you store all that PII on registration and that you have some good arguments why storing that information is a &quot;legitimate interest&quot; of your organization.
Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Thus, I think it would be invalid to charge a fee for an address change if that change was made in exercise of your data subject rights. If you didn't invoke this right, it's debatable whether charging a fee would be proper. On the one hand, they can charge whatever service they want (provided that this was part of the contract you entered). On the other hand, they have an obligation to assist you with your exercise of data subject rights. This includes recognising a data subject request even if you didn't explicitly invoke the specific GDPR article. For example, refusing a request for erasure just because you didn't invoke some magic GDPR words would be clearly noncompliant in my opinion. If the company offers multiple customer service options, charging for some of them may be all right. Typically, the lowest-cost solution for a company to deal with GDPR requests is to offer an online self-service option. An email to the data protection officer would typically also be free. Charging for phone support might be fine though. In an insurance context, there could also be a legitimate claim that updating your address is not a mere correction of your personal data, but a modification of the contract (depending on what you're insuring). Another possible counterpoint (which I think is not valid though) would be that the company never stored inaccurate data and therefore doesn't have to satisfy a rectification request.
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.
The basic requirements for the effectiveness of valid legal consent are defined in Article 7 of the GDPR and specified further in Recital 32. There is no form requirement for the consent, so using a button is not a problem. However, I do not think the MailChimp-button you reproduce as an example is good enough. It asks for a blanket consent to stuff that is buried in MailChimp's “Anti-spam Policy &amp; Terms of Use”. But according to the GDPR, what the data subject consent to can’t be buried in the ToU – it must spelled out in clear, plain language. Requests must be granular, asking for separate consent for separate types of processing. “When the processing has multiple purposes, consent should be given for all of them” (Recital 32). Blanket consent, as used by MailChimp, is not allowed. The other clear requirement from the GDPR is that opt-in is mandatory. Pre-ticked and opt-out buttons are explicitly banned: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent” (Recital 32). ‘No’ must become your data default, but if the user chooses to opt-in by clicking a button, this is valid consent. The MailChimp-button complies witrh this. The GDPR also requires you to keep a records of the consents given (so make that part of the user profile), and to withdraw consent at any time &ndash; so you make make provisions for that as well in your implementation of consent.
Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance: […] an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; — GDPR Art 4(1) However, this definition does show that “identifiable” should be interpreted rather broadly. For example, indirectly identifying data is still identifying data – there doesn't even have to be a strong identifier like a name, passport number, or street address. It is also not necessary that identification enables you to determine the real world identity – identification is anything that allows you to single out a person, or to combine data into a profile of that person (compare Recitals 26 and 30). In any case, an online username or user ID is clearly an identifier and will fall under one of “a name, an identification number, […] an online identifier”. If in doubt, ask your data protection authority for guidance. You've correctly understood that you will need a legal basis to process this data, and that legitimate interest could be that legal basis. This doesn't have to be your own interest, so a community interest would be OK. You need to balance the user's rights against this interest. You have performed this balancing and have found that the interest outweighs these rights. You've noted that such leaderboards are a cultural norm and are generally expected, which strongly weighs in your favour. However, legitimate interest is not a free pass but just means an opt-out solution (right to object per Art 21). You should also inform users that the leaderboard is accessible publicly when they join your server (transparency principle per Art 5(1)(a) as detailed by the information obligations in Art 13). In particular, you should use a “message of the day” or welcome message functionality to link to your privacy policy. You should also be aware that other rights such as the right to access, erasure, and data portability apply. As an alternative to legitimate interest (opt-out) you could also consider consent (opt-in), though this results in slightly different data subject rights and is more difficult to do correctly. But I'd agree that legitimate interest is more appropriate here.