Recently I contacted Citi bank which kept sending me spam, including "bank statements" I could not access, which makes perfect sense given that I don't have an account with them.

I was told that they had no record of me and that if I want to be super duper sure they're right I should send a physical letter with a scan of my Id to their offices.

After another few months of getting spammed by them, I sent them a GDPR data subject request instead. After a few days I received a message stating that:

1) my email was removed from their mailing list (yay)

2) they didn't/process have any of my personal data, but

3) since I shared my personal data with them _via the data subject request_, they're obliged to keep it

I'm not angry, I just enjoy the irony and absurdity of the entire situation. In a sense, large orgs like this are as coherent as GPT-3 is away of what it's talking about.