On May 25, 2018 the European Union's General Data Protection Regulation (GDPR) came into effect, bringing with it the most expansive governmental effort to regulate data security and privacy to date. Among the GDPR's many provisions is the "Right of Access," which states that individuals have the right to access their personal data. This provision can be easily abused by social engineers to steal sensitive information that does not belong to them.
My research centers on a practical case study wherein I attempted to steal as much information as possible about my fiancé (with her consent) using GDPR Subject Access Requests. In a survey of more than 150 companies, I demonstrate that organizations willingly provide highly sensitive information in response to GDPR right of access requests with little or no verification of the individual making the request. This ranges from typical sensitive identity data like addresses and credit card information to esoteric data such as a history of train journeys or a list of domains owned. While far too often no proof of identity is required at all, even in the best cases the GDPR permits someone capable of stealing or forging a driving license nearly complete access to your digital life. Moreover, the highly standardized nature of GDPR requests makes it possible to automate this process at immense scale and provides one of the most reliable general phishing attack typologies to date.
This is a solvable problem, and one which could have been incorporated into the initial GDPR if regulatory legislation were subjected to security assessments like those used for modern software. The presentation suggests possible remediations and offers a cautionary tale for future policymakers designing GDPR-inspired privacy legislation. It also suggests short-term ways in which individuals and businesses seeking to protect themselves against these attacks.