How about comparing a hash of the encrypted data?
But wait, that never happened because it was a dup.
That means they can, and will, decrypt somebody else's data to serve your request. Cute, huh?
How about comparing a hash of the encrypted data?