Hacker News Reader

Comment by williamstein | Hacker News Reader

I suspect it was far more than 1000 emails, because my small company got one. It scared us and wasted significant time (eg as we carefully read the relevant CA law). At the time we concluded that it was highly likely to be a phishing scam and archived the message with no response. In addition we decided not to respond because the person asking the question was not a paying customer. I definitely did feel threatened by the way the email was worded.

View on HN

According to this tweet, it was 200-300,000 emails. Absolutely shocking. https://twitter.com/ehasbrouck/status/1473669157681909764?s=...

That with my (conservative, I believe) estimation would make 6-9,000,000 US$.

Let's make it 10,000,000 US$, that were "wasted".

Sending 200-300,000 of such mails makes no sense whatever, AFAICT a study (besides the ones with 12, 18 or 33 participants), if the sample is random enough, with 1,000-10,000 should give accurate enough results.

In the good ol'times (snail mail) sending 200-300,000 letters would have costed probably 200-300,000 US$, I doubt that the Uni (or its IRB/whatever commission) would have approved this kind of expense.

I would be fascinated to read the original copy. there's a lot of information missing in this story.

Apparently this was the last line, as reported by the honeypot blogger: "I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code."

The mail reads:

To Whom It May Concern: My name is … , and I am a resident of Paris, France. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? What personal information do I have to submit for you to verify and process a GDPR data access request? What information do you provide in response to a GDPR data access request? To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding zylstra.org, I kindly ask that you forward my request to them. I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. Sincerely,

That's it? I just don't see how this is so burdensome even if you don't have a data deletion process in place (i.e. probably aren't complying with CCPA/GDPR). It's basically just saying "how can I ask for my data to be deleted and prove which user I am". I'm prepared to answer these questions for my side projects so it seems like a business should be able to answer them.

> I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR.

This is the threatening part, but it's also bogus. The wording of the GDPR does not require a business to answer such an email, unless the sender actually wants to submit a data access request. But previously, the sender denied the intent to do so:

> To be clear, I am not submitting a data access request at this time.

Thus, the email is perceived as spam at best and a threat at worst.

Reply on news.ycombinator.com