arbiter
JournalsAccount

From Shield to Sword: How Data Privacy Can Undermine Data Security

Alexander Gladis et al.

Information Systems Research2026https://doi.org/10.1287/isre.2023.0566article
FT50UTD24AJG 4*ABDC A*
Weight
0.50

Abstract

What is the point in hacking computer systems when organizations voluntarily disclose personal data to anyone who asks convincingly? We show that the European GDPR is paradoxically exploitable for identity theft despite being designed to protect personal data. Subject access requests (SARs) according to its “right of access” (Article 15) can be weaponized by impersonating a victim and submitting fraudulent SARs in their name. We task attackers with stealing the personal data of three volunteers (highly privacy aware person, average user, and semipublic figure) in a real-world setting. These attacks could be replicated by just about anyone. Yet, they obtained sensitive personal data, including addresses, phone numbers, national ID and bank account information, and insurance data. Based on 718 submitted SARs and 21 interviews with data protection officers, we tell a frightening, yet fascinating story of how these identity thefts unfold, expose flaws in how organizations process SARs, and uncover a systemic weakness in the GDPR. We analyze the underlying factors enabling such attacks, assess their real-world impact, and explore mitigation options for individuals, organizations, and lawmakers. Our insights have important implications for how data privacy and data security interrelate and how we manage and regulate them.

Open via your library →

Cite this paper

https://doi.org/https://doi.org/10.1287/isre.2023.0566

Or copy a formatted citation

@article{alexander2026,
  title        = {{From Shield to Sword: How Data Privacy Can Undermine Data Security}},
  author       = {Alexander Gladis et al.},
  journal      = {Information Systems Research},
  year         = {2026},
  doi          = {https://doi.org/https://doi.org/10.1287/isre.2023.0566},
}

Paste directly into BibTeX, Zotero, or your reference manager.

Flag this paper

From Shield to Sword: How Data Privacy Can Undermine Data Security

Flags are reviewed by the Arbiter methodology team within 5 business days.

Evidence weight

0.50

Balanced mode · F 0.40 / M 0.15 / V 0.05 / R 0.40

F · citation impact0.50 × 0.4 = 0.20
M · momentum0.50 × 0.15 = 0.07
V · venue signal0.50 × 0.05 = 0.03
R · text relevance †0.50 × 0.4 = 0.20

† Text relevance is estimated at 0.50 on the detail page — for your query’s actual relevance score, open this paper from a search result.