Even so, in isolation and moderation the questions make good sense and answering them properly using an automated system and an updated privacy policy should not be a huge burden.
Look, we all know that you think the GDPR is a great idea, but a law which can't be used to its full extent is IMHO not a great law. I agree with the goals of the GDPR: they're laudable. But its details & its implementation are, quite simply, wrong.
You don't install a self-destruct mechanism which can be triggered by just pushing a single un-guarded button. Likewise, you don't pass a law which can inflict grave economic harm just by sending a letter.
It's probably not even possible to create a great law. The industry that can't even agree on something as simple as coding guidelines is suddenly screaming that the law isn't good (enough).
This letter is designed to inflict maximum administrative paperwork without first establishing whether abuse has taken place.
Also, "grave economic harm" cannot be dealt with such a simple letter. The maximum fine cannot be levied by individuals, only regulators, and they will not do so for individual cases.
It's not about wether the information is useful or not, it's about seeing what a company has.
If I get some unsolicited comms from a company then I'm going to want to get information about all the data they hold on me, preferably including where they got it from and where they sent it to.
Keep in mind that the writer of the letter claims he/she is a 'customer of the company', so a friendly relationship, not a hostile one like the one that you are describing. Those are totally different situations and different strategies apply.
> I would like you to be aware at the outset, that I anticipate reply to my request within one month as required under Article 12, failing which I will be forwarding my inquiry with a letter of complaint to the <appropriate data protection authority>.
and I don't really see that as a threat, more of a "directing of the proceedings". I mean, it's fact. If some company doesn't respond in the way I think they should to then that's exactly what I will be doing. This isn't a love letter, I don't see any harm in stating fact about this. I can totally see how it could be taken either way though.
I also agree the letter is going after everything, and everything is going to be painful for companies, but for me personally the pain is going to be a byproduct of wanting to know everything.
To be clear, companies that have made efforts to comply with GDPR that I've directly engaged with I'm not interested in and am going to leave alone, but the next unsolicited email from a recruiter I get will start a cascade of access then deletion requests up to the point where my information entered the system, painful or not.
Since this is all standard, I would generally believe a serious-toned legalese template letter that referenced real possible consequences for non-compliance would be a no-brainer first place to start.
For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'.
To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.
It that case, I want to know about all the data that company has regarding me, and how they got it. Most likely I also want them to delete it too.
Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy.
I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem.
In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
Agreed, but that's not the letter writers goal.
> It that case, I want to know about all the data that company has regarding me, and how they got it.
Agreed.
> Most likely I also want them to delete it too.
No, you absolutely want them to delete it, and besides that to tell you if they passed it on.
> Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place).
Yes, but the letter writer is by their own admission not in that situation, they're a customer of the company, so a direct relationship between them and the company exists, which most likely was initiated by the letter writer.
> And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy.
Agreed, but again, that is not the context.
> I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem.
No, it will be used for trolling, in fact it already is being used for trolling. And that's a net negative, which if enough idiots do it will cause the GDPR to be devalued to the point where it is no longer very useful.
> In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
That's the whole problem isn't it? Check the context in which the original letter (see link in article) is presented. It's a clear example of trolling.
On reading the template, it seems super obvious that it doesn’t assume a goal of only being applied to situations when you’re already a highly engaged customer.
Things might be on a spectrum. I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account.
It would be fine to call myself “an existing customer” in that case, even though my connection to the company is not like a vigorous customer relationship with a company whose services I use all the time.
That’s just a common idiom, very clearly not intended to mean the template is intended for spamming around to every big box company you’ve ever engaged with or something.
You can write, “I’m your customer,” while still feeling that you don’t trust that company and what your request for a comprehensive overview of how they use your data to be taken seriously (hence the template’s value).
In that case it looks like the burden lies with you, not with the company and to send a letter like this in that context would be total overkill. I'd start off with a simple request to remove my data.
Another way to put it is: I’m generally deeply mistrusting of corporate entities collecting my data at all — even very upstanding corporate entities — and believe basic prudence requires me to treat them all with skepticism about my data.
If you ask someone whether they are complying with the law, you're likely to just get an inconsiderate "yes", with no indication they even understand the law (there is certainly plenty of misunderstanding that I have seen already, from companies large and small). Making specific questions about their business practises, such that they will have to plainly lie in order maintain a false claim of compliance is more rigorous.
But different strokes for different folks, of course everybody is free to do what they want. But then you should be aware that a torrent of these requests are not going to help make matters better, they will just cause people to tune out and regulators to stop taking the complaints serious.
It's like bringing a chainsaw to a surgery.
There have been enough data breaches that distrust is always warranted when a company has my data.
Asking for the maximum shows you exactly how compliant an entity is.
As it stands it's clearly an attempt at causing the wheels to grind to a halt, the title of the request and the context in which it has been presented are evidence of that as is the faux concern laced through the letter. This is not a request made in good faith.
If they can't give a convincing answer, then bigger guns are appropriate.
But if all you want to do is cause work 'just because you can' then you're on a fishing expedition without an actual cause. The claimant in the letter is clearly aware of that and how it would make them look in the eyes of the regulators if they were to forward a complaint hence the 'set up' at the beginning of the letter indicating some kind of faux concern in spite of being a 'customer'.
The dissonance there is pretty strong, if I'm a customer of a company in good standing this is not how I would address them.
But it feels to me that if I'm processing personal data about my users, then it's reasonable for them to ask what it is and where it is.
There are overheads that come with doing business.
GDPR is going to shake out some of the companies that are competent at using personal data but incompetent at telling people what it is and where it's stored.