Streaming service DAZN took almost five years to answer a simple access request | Hacker News Reader

Streaming service DAZN took almost five years to answer a simple access request

noyb.eu

53 pointslatexr20 comments

Open articleView on HN

I wonder what falls under this "access to data" law.

Say Anna and Benjamin have email accounts with the same provider.

Anna sends an email to Benjamin.

Anna deletes the email from her outbox.

The provider still knows that Anna sent the email and the content. Because it is still in Benjamin's inbox.

When Anna requests access to everything the provider knows about her - does the provider have to give her the email from Benjamin's inbox?

I don't think by that time it belongs to Anna.

If an email existed on her mailbox, it would be hers. Once it was out of her email, she would not be able to claim ownership of it.

It doesn't matter if Anna "owns" the data; The GDPR doesn't care who owns data. What matters is who controls it and what processing they do on it (with storage considered processing).

Does Anna have control over benjamins inbox?

No, but Benjamin does, so if Benjamin's use of Anna's personal data in the inbox is in scope of the GDPR then Anna has rights that she can enforce against Benjamin.

I don't believe that GDPR applies to a mailing list, let alone to private email between individuals. Does someone have chapter and verse?

GDPR article 2(2)c. It will not apply to the receiver of the email, but maybe to the provider. Perhaps it depends on the kind of relationship between the two parties. Mailing lists will be covered.

Side note: I know someone who requested their data to their DPA, and part of the response contained emails mentioning them and their complaints in the _content_ of the message (they were not in the From:, To:, Cc:, or Cci: fields). All names and emails address were censored, though, in accordance with 15(4).

It depends - what's the purpose of the mailing list? If it's for purely personal or household purposes (e.g. a group of friends/family) then it's out of scope by virtue of Article 2(2)(c). Otherwise it'd likely be in scope with the list admin being the data controller.

The GDPR article 15 states that the data to be provided is "personal data", which is data that can be used to identify you. E.g. name, address, location, tracking ids. Text of an email does not come under personal data so not covered by the access to data law these people were testing.

https://commission.europa.eu/law/law-topic/data-protection/r...

Wouldn't it be considered personal data if the emails were to contain personal data? For example, emailing your shipping information or other personal data, signing off with your full name and phone number, etc.

Another test under GDPR is if the data is stored in a way designed to make looking it up easy. I forget the exact working, but broadly personal data stored in records designed to make looking up that data easy falls under a “right to data” request, and data that isn’t recorded like that doesn’t.

As a consequence personal data that exists only within the content of an email wouldn’t be considered. Just like free form notes wouldn’t be considered, unless the notes were filled and recorded in a manner that made lookup easy.

Then there’s also other people’s right to privacy. Your right to data doesn’t provide you with a right to intrude into other people privacy. So emails in your account, and records associated with your account are all fair game, but you don’t have a right to reach into other people’s account for data, or a right to force companies to perform super broad searches across every piece of data they have, just in case your name or similar appears in it.

Of course all of these laws have space for interpretation, but that’s why we have courts. They’re ultimate arbiter of edge cases where it’s not clear what the correct cause of action is.

Your link gives "an email address" as one of the examples for personal data.

And Anna's email address is part of the email in Benjamin's inbox.

Anna's email address is not Benjamin's personal data. The GDPR requirement is for the requester's personal data, not personal data of anyone else.

>"personal data", which is data that can be used to identify you. E.g. name, address, location, tracking ids.

This is wrong - very wrong.

Article 4 defines personal data:

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"

it's an interesting question, but i think the "right" answer here would be that the emails should (in the rfc sense of the word) be end-to-end encrypted, thus there wouldn't be a way to do this at all

The email provider in this scenario is almost certainly not the data controller - Benjamin is - so no.

And if Benjamin is using their email inbox in a purely personal manner then it'd be out of scope of the GDPR entirely.

Spotify’s data export does not include all of your data. I haven’t had time to take them to task on this.

https://noyb.eu/en/spotify-fined-eu-5-million-gdpr-violation

You don't need to, donate some money to NOYB.eu who will do it for you.

The same company which allowed a user to use my own email address to create an account without even verifying their email address?

The same company spamming my email address with a newsletter which I can't unsubscribe from?

The same company where you contact their DPO and they won't reply?

Yes, I've heard about them...

Reply on news.ycombinator.com