A few days ago I sent a GDPR request to some company to delete my personal data. They said to install their app and send a ticket from the app. The email was sent from the email address to which the account is registered. Is this even legal?
this post was submitted on 23 Oct 2023
878 points (98.2% liked)
Privacy
31991 readers
496 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Being friendly doesn't negate the fact that they are out of compliance with the law. Even sending a second email to insist they delete your data is an undue burden.
You're right, but sometimes a bit of undue courtesy repays in dividends. Not every minor infraction is nefarious and not every minor infraction deserves reporting. A simple courteous reminder of their obligations may save both parties some undue hassle.
I can imagine this company doing this to ensure only authenticated users can have their data removed. There are other ways...but this was probably what they considered reasonable and painless for all, admittedly they (wrongly) didn't consider the audience of this community in that decision.
Actually, the customer is already getting undue hassle, while the company is just breaking the law. Why can't we just expect better?
Nobody broke the law lol.
I believe they have like a month to comply.
The just asked for a ticket in the app, to make their lifes easier. If OP doesn't want to, they still have to comply though.
Now I remember why I hate working directly with customers.
According to my training when I was handling my workplace's GDPR request email companies have 30 days to respond. Meaning they could simply have a bot respond to all incoming emails on day 29 and say "we're reviewing your request" and be in compliance for a while longer