About one in four companies revealed personal information to a woman’s partner, who had made a bogus demand for the data by citing an EU privacy law.

The security expert contacted dozens of UK and US-based firms to test how they would handle a “right of access” request made in someone else’s name.

In each case, he asked for all the data that they held on his fiancee.

In one case, the response included the results of a criminal activity check.

Other replies included credit card information, travel details, account logins and passwords, and the target’s full US social security number.

University of Oxford-based researcher James Pavur has presented his findings at the Black Hat conference in Las Vegas.

It is one of the first tests of its kind to exploit the EU’s General Data Protection Regulation (GDPR), which came into force in May 2018. The law shortened the time organisations had to respond to data requests, added new types of information they have to provide, and increased the potential penalty for non-compliance.

“Generally if it was an extremely large company – especially tech ones – they tended to do really well,” he told the BBC.

“Small companies tended to ignore me.

“But the kind of mid-sized businesses that knew about GDPR, but maybe didn’t have much of a specialised process [to handle requests], failed.”

He declined to identify the organisations that had mishandled the requests, but said they had included:

  • a UK hotel chain that shared a complete record of his partner’s overnight stays
  • two UK rail companies that provided records of all the journeys she had taken with them over several years
  • a US-based educational company that handed over her high school grades, mother’s maiden name and the results of a criminal background check survey

Mr Pavur has, however, named some of the companies that he said had performed well.

James PavurIMAGE COPYRIGHT JAMES PAVUR
Mr Pavur says he believes he did not break the law himself while conducting the trial

He said they included:

  • the supermarket Tesco, which had demanded a photo ID
  • the domestic retail chain Bed Bath and Beyond, which had insisted on a telephone interview
  • American Airlines, which had spotted that he had uploaded a blank image to the passport field of its online form

One independent expert said the findings were a “real concern”.

“Sending someone’s personal information to the wrong person is as much a data breach as leaving an unencrypted USB drive lying around, or forgetting to shred confidential papers,” said Dr Steven Murdoch, from University College London.

Time limit

Mr Pavur’s bride-to-be gave him permission to carry out the tests and helped write up the findings, but otherwise did not participate in the operation.

So for correspondence, the researcher…

Read The Full Article at BBC

Check Also

IAB Europe’s advertising bidding model uses personal data, EU court rules

After clarification from Luxembourg, the Belgian Court of Appeal will now rule on the case…