gdpr fraud
Whats the consumer&#39;s rights when an online account has been breached?
<p>I have an online account with the Company "A". On that account my PayPal account is linked.</p>

<p>A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not huge, thank god). I checked the transactions info and it was through PayPal, and Company "A" was listed under PayPal's Transaction details. I contacted that company, I explained what happen and soon they refunded the amount.</p>

<p>Then I asked them to explain me what happened but they refuse to answer. As a consumer do I have the legal right for an explanation? How the GDPR can enforce my legal rights on that case?</p>

<p>I totally understand that they refunded the amount but, in nowadays they should be more sensitive with cases like these.</p>

<p>Unauthorised access to your account, which granted access to personal data, would have constituted a data breach under GDPR. The obligations incumbent upon the controller (Company A) may include informing their supervisory authority and/or the data subject (you) once they became aware of the breach. When you reported it, and they received that report, the clock started.</p>

<p>Under the GDPR you have the right to request access to personal data held about you, which should include data about the fact - or not - of a data breach. You can also specifically ask whether there was a report, a data breach, whether the supervisory authority as informed, and what data if any was accessed. If they have such records and are aware, they must provide it to you except where that would violate the privacy of another living human being (natural person).</p>

<p>You could also find out which is their lead supervisory authority and ask them what to do in this specific case.</p>

<p>From what I read, it sounds like Company A made a mistake, and rectified it within a reasonable time of being made aware of it.</p>

<p>Fraud would imply intent to permanently deprive you of your funds. It looks like Company A has shown no such intent, and has demonstrated the opposite by providing a refund.</p>

<p>It seems the company was processing your personal data as part of [what they believed to be] an ongoing contract, which is a lawful basis for processing under GDPR.</p>

<p>On the evidence at time of posting, there does not appear to have been a breach of the security of your Personal Data by Company A.</p>
