It's certainly an overstep, but just the hash they're sending wouldn't be PII.
replyThe hash itself is irrelevant.
replyThe question is what PII does HIBP collect on submission (eg IP address), and with whose consent, and for which purposes?
All that should be explained in excruciating detail in the ticket and in the documentation, to begin with.
What PII do you think is being sent to HIBP?
replyI am curious thought that how it would be illegal according to GDPR. They are hashed after all, and the same hash is not used for authentication.
replyUndoing personal information for a purpose different than the purpose for which it was collected.
reply