Is it a possible vulnerability / GDPR violation if basic profile of users are enumerable through the URL?

Question

If a website uses an auto-incrementing user-id in its url – /users/1, /users/2 to showcase public user profiles (just the name + photo / avatar) is it considered a possible vulnerability?

We cannot comment on whether anything might violate regulations. That's more of a legal question requiring interpretation. — schroeder, Jan 23 '20 at 15:21
Have you considered that this site does exactly what you describe? https://security.stackexchange.com/users/225626/ — schroeder, Jan 23 '20 at 15:21

score -4 · Answer 1 · edited Jan 23 '20 at 15:19

From GDPR PII Definition:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Which means, that you should create some kind of notification, that will notify a user that the data he is submitting to the website are publicly accessible. If not, then you violated GDPR.

This is not an answer at all to what was asked – schroeder Jan 23 '20 at 15:19 — schroeder, Jan 23 '20 at 15:19

Is it a possible vulnerability / GDPR violation if basic profile of users are enumerable through the URL?

1 Answers1