Is an email enumeration vulnerability a breach of GDPR?
<p>I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows:</p>
<ol>
<li>User inputs their email</li>
<li>If the email belongs to an existing user, report this via an error message. This might be on submitting the form or immediately as the user inputs the email.</li>
</ol>
<p>The issue here is that an (unauthenticated) user can use this to determine what emails are in use in the system. From a technical perspective there are ways to limit the damage (e.g. rate limiting) but my question is what the GDPR implications are of such a vulnerability, and what responsibility does the developer/company have to avoid this?</p>
<p>I'm aware the emails are categorised as PII, which leads me to believe that it is an issue. However, it's also very common to see this flow in the wild.</p>
<p>For context I'm based in the UK and work for a company operating in the UK and EU.</p>

<p>This is a good question, as it raises an issue which places the controller's interest in providing a smoothly functioning customer sign up process against customers' right not to have their data leaked.</p>
<p>Note that it is not necessary to consider &quot;enumeration&quot; here. Even just being able to check whether one person has a registered account raises the issue.</p>
<p>The relevant provisions of the EU GDPR (or in the UK, the UK GDPR as defined in sections <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/3" rel="noreferrer">3(1)</a> and <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/205" rel="noreferrer">205(4)</a> of the Data Protection Act 2018) are (emphasis added):</p>
<blockquote>
<p>Article 4(2): <strong>'processing’ means</strong> any operation or set of
operations which is performed on personal data or on sets of personal
data, whether or not by automated means, such as collection,
recording, organisation, structuring, storage, adaptation or
alteration, retrieval, consultation, use, <strong>disclosure by transmission,
dissemination or otherwise making available</strong>, alignment or combination,
restriction, erasure or destruction</p>
</blockquote>
<p>So, disclosure of the fact that a user has a registered account amounts to &quot;processing&quot;.</p>
<blockquote>
<p>Article 6(1): <strong>Processing shall be lawful only if and to the extent that
at least one of the following applies:</strong><br />
(a) the data subject has given <strong>consent</strong> to the processing of his or her personal data for one or more specific purposes;<br />
(b) processing is necessary for the performance of a <strong>contract</strong> to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;<br />
(c) processing is necessary for compliance with a <strong>legal obligation</strong> to which the controller is subject; <br />
(d) processing is necessary in order to protect the <strong>vital interests</strong> of the data subject or of another natural person;<br />
(e) processing is necessary for the performance of a task carried out in the <strong>public interest</strong> or in the exercise of official authority vested in the controller;<br />
(f) processing is necessary for the purposes of the <strong>legitimate interests</strong> pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>
<p>Of these, only (a) and (f) are likely to be of any relevance:</p>
<ul>
<li>(a) is not too useful since it isn't feasible to design a sign-up system that depends on the user's consent (which they may not give).</li>
<li>That leaves us with (f). As noted by the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/" rel="noreferrer">Information Commissioner's Office</a>, &quot;<em>Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.</em>&quot;.</li>
</ul>
<p>The legitimate interest here would be that you need a sign up system which prevents duplicate registrations. Remember though that the processing has to be &quot;<em>necessary</em>&quot; for the purposes of the legitimate interest. One might argue that it is not since you could design the system to give the appearance of accepting the duplicate registration followed by sending an email to the account holder to inform them. On the other hand this will result in a less user friendly experience which could itself be a legitimate interest.</p>
<p>Ultimately this is a balancing exercise and it is hard to say whether you have struck the right balance until someone complains to the ICO or the court and a decision is issued. The fact that the practice is widespread among well-resourced and large companies would tend to indicate that it is lawful albeit this is not conclusive in the absence of a court decision. I'm not aware of any cases involving this particular issue but would be interested to hear from others on this point.</p>
<p>If the processing is unlawful then Article 18 is applicable:</p>
<blockquote>
<ol>
<li><p>The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: [...]
(b) the processing is unlawful and the data subject opposes the
erasure of the personal data and requests the restriction of their use
instead</p>
</li>
<li><p>Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed
with the data subject’s consent or for the establishment, exercise or
defence of legal claims or for the protection of the rights of another
natural or legal person or for reasons of important public interest of
the Union or of a Member State.</p>
</li>
</ol>
</blockquote>
<p>In other words, the data subject could ask you not to disclose their registration status via the sign up page, and you would be obliged to comply with the request.</p>
<p>Separately from the above points, in order to be lawful you must provide the data subject with certain prescribed information <em>at the time</em> when the data is collected. Of particular relevance here are the following items:</p>
<blockquote>
<p>Article 13(1): Where personal data relating to a data subject are
collected from the data subject, the controller shall, at the time
when personal data are obtained, provide the data subject with all of
the following information: [...] (c) the purposes of the processing
for which the personal data are intended as well as the legal basis
for the processing; (d) where the processing is based on point (f) of
Article 6(1), the legitimate interests pursued by the controller or by
a third party;</p>
</blockquote>
<p>So even if you conclude that the processing will be lawful you will have to give some consideration to the basis so that you can comply with the above provision.</p>

united-kingdom gdpr software european-union