I’m surprised nobody has mentioned that being forced to provide personal data on request does not in any way reduce the risk of personal data being misused.
What’s the damage consumers are being protected from, exactly?
What’s the damage consumers are being protected from, exactly?
A well-known researcher once joked to me that programmers are associated with a company for a few few years, programs live only for a few more years, but data lives forever.
How? What procedure improves security?
Right now, people I don't know at various companies have access to databases with my personal information. Those same people will still have the same access and opportunity to misuse my personal information, but under GDPR I can know what personal information is stored. I could also demand it be deleted, but that doesn't apply to data that's already been shared or under control of other parties.
For a company to be GDPR compliant they also have to satisfy the regulators and that includes limiting access to data to only those that need it, knowing who those people are and putting measures in place in case of a breach.
It may also incentive companies to play more carefully with the data, since they have to explain what that have done with it.
If your data is stores in certain jurisdictions that have difference laws than you expected, that could increase the risk your data bight be accessed in ways you assumed illegal (different countries have different rules).
For a very simple example, LiveJournal is now owned and operated entirely out of Russia. It didn't start that way. a GDPR request would presumably let you know that your data was in servers in Russia, or that the company in question did not feel the need to answer your request, in which case at lest you would know that your local laws did not apply towards it. In my eyes, both are very useful information that provides additional information about the risk of that data being accessed in a way you thought it would not beyond what you might assume of an EU company that you gave personal information.
Whether data is hosted in Russia or the EU it’s at risk of being stolen, exposed, and misused and the liability companies have for that has not changed (there is no liability)
So your contention is that the same risk exists no matter the storage location?
Bad things can happen anywhere. I submit that certain locations are more prone to certain situations. Knowing your information is being stored in a certain location at a minimum gives you the opportunity to deny additional information from yourself (stop using the service).
Since this discussion has regressed to the point where you're essentially arguing that additional information has no utility, and I fundamentally disagree with that point, I'm not sure the point of continuing. We're just repeating our points with different examples.