I'm aware of this post that GDPR apparently does not enforce a specific standard to secure sensible data. Based on this post e.g., there is no requirement to encrypt or hash login data in a local database, either.
GDPR however provides the user of a service the right to know what data are stored in the service's data base, and their purpose in this database. Based on these two, I would like to know: Does an individual user has the right to know how the login user name is stored in the service' database? With services like https://haveibeenpwned.com/ displaying possible breaches as known to them as one indicator, does it depend on courtesy if, e.g. my phone provider to disclose «we secure your login credentials hashed, with sha512sum / blake2». Or, are there companies in Europe which disclose this part of their applied cryptography voluntarily in their contract / on their website?
I'm willing to move this question to law.stackexchange if this question is not suitable for the current forum.