My Data Request: Request your data from over 100 companies | Hacker News Reader

My Data Request: Request your data from over 100 companies

mydatarequest.com

107 pointsmikece27 comments

It concerns me that the site providing information about privacy policies, data subject rights, and privacy laws has a privacy policy that doesn’t even comply with the law. The policy states that they collect “non-identifiable information... which is collected passively using various technologies.” But that’s an incorrect statement of law. Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws. Also missing a lot of other stuff...

> Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws.

Your argument is at least formally wrong, the GDPR does not contain any such concept as personally identifiable information. It covers personal data.

An IP address can be personal data under some circumstances.

IANAL, but I would be more than surprised if the interpretation of personally identifiable information and personal data ends up to be identical in legal practice. I'd assume that even lawyers are not sure yet, because there isn't any practice yet.

I used a broad term to encompass laws of various jurisdictions, but my statement is correct. Personal data is any information relating to an identified or identifiable natural person. Thus, personal data by its definition includes PII. But not all personal data is PII. Personal data also includes other data such as pseudonymized data (such as hashed IDs). In any event, the company needs to revisit its privacy policy.

It only covers personal data if it can be used to identify a natural person, so your quibble about that not being PII is a bit odd.

Might be an interesting idea to hit them with a GDPR data request letter and see how they handle it. Practice what you preach and all that.

I was initially expecting to enter my email for it to make requests, but it instead gives info on how I can request for information from sites individually. A bit more effort but makes me feel a bit safer as a result.

I see that there's a way to suggest it to "request for me" as well, so that covers all bases!

While it is great, there are many instances where you can't make a data request without making an account first including facebook and google services (Alphabet is not on the list btw) which quickly brings up the question, especially if you are European, how to report GDPR violations[1]?

[1]https://news.ycombinator.com/item?id=17318773

I have actually written to facebook (without having an account) and requested my personal data, worked fine. I believe the adress I used was support@facebook.com. They replied that they do not have any data on me. They requested a copy of my ID though, if I remember correctly.

I have no doubt they straight up lied to you.

Don't see how the gain from that would be worth the risk.

They certainly did lie.

When I created a new (my only) facebook account a few years back, it was clear they already knew that about 90% of my friends knew me.

They probably interpreted “what information do you have” as “give me a copy of my account”. If they still do this, someone in a GPDR country (but without a FB account) should go through this exercise, then report the violation.

There is zero risk and they get money.

They requested a copy of my ID though

I saw this practice in the wild, however I don't quite agree with supplying of any more information. Emails and phone numbers are most often used for identification on the web. What can they even do with an ID? Surely most sites don't store ID numbers.

They still need to defend against malicious requests; for example how do you know that it's not someone's potential enemy requesting for that information?

But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym?

Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.

They need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc.

At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases.

However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.

"The only personal data we have been able to identify related to you is the ID you just sent us. Have a good day."

> They replied that they do not have any data on me.

How could they transmit that info? They at least have stored your mail address.

I love the idea here, but I submitted some feedback before: Specifically, I think they should provide a clear notation of which have automated export tools and which do not, and a news feed for when the methods of data access become available. The site would be much more useful if I could quickly use it to locate export tools.

Hmm, shame it doesn't automatically submit the request to all 100 companies on my behalf...

That usually requires having access to the account in question. Are you willing to grant that?

Do you actually have accounts with all 100 companies?

If not why would you send them on a wild goose chase?

I really like the idea, but a part of your program should check the links for contact forms to ensure they remain up-to-date. The one for IKEA didn't work for me.

As a company, what format should we supply user data if requested?

See:

[1] "So Your Startup Received the Nightmare GDPR Letter " which contains

[2] "Is there amy regulation about how the data has to be formatted? Say I send a json string like "this is LITERALLY the data we use", but the avergae Joe is left irritated and annoyed, am I in trouble?"

---

From the ICO: (the UK regulator)

How should we provide the data to individuals?

If an individual makes a request electronically, you should provide the information in a commonly used electronic format, unless the individual requests otherwise.

The GDPR includes a best practice recommendation that, where possible, organisations should be able to provide remote access to a secure self-service system which would provide the individual with direct access to his or her information (Recital 63). This will not be appropriate for all organisations, but there are some sectors where this may work well.

However, providing remote access should not adversely affect the rights and freedoms of others – including trade secrets or intellectual property.

Ref: https://ico.org.uk/for-organisations/guide-to-the-general-da...

---

[1] https://news.ycombinator.com/item?id=17177817

[2] https://news.ycombinator.com/item?id=17178125

Great service, thank you!

Seems down...

Reply on news.ycombinator.com