A few days ago I sent a GDPR request to some company to delete my personal data. They said to install their app and send a ticket from the app. The email was sent from the email address to which the account is registered. Is this even legal?
No, it’s not at all legal for the company to do this. Reply and remind them they have one calendar month to comply from the date of your original request, otherwise you will make a complaint to which ever information regulator is correct for the juridiction they’re operating in.
I’m a lawyer specialising in Data Privacy, reply here if you need more help on this one.
Also feel free to name the company.
For now, I do not want to announce the name of this company publicly.
If they don’t want to solve it amicably, then I will do so.
They already said they don’t want to.
They asked you to install the app on purpose, in hopes that you’ll decide it’s too much hassle and decide not to delete the account.
How do you know this?
My first thought was “they probably want to ensure they are who they say they are and so want an authenticated request” - while that’s against GDPR, not everyone is as educated as they should be, and not every mistake is a nefarious activity.
Think of the poor corporation! If they get punished for their illegal buisness practices, it’ll hurt the economy and people will be less inclined to start a small buisness. Didn’t you study piss down economics?
Must be something that makes you look bad lol
Otherwise you’d just say it. You owe them nothing and they’ve broken the fuckin law and you’re protecting them? What do they have on you?
Or maybe they just want to disclose as little of their personal information, including services relied on, on an open platform like this. Idk if that’s the case, but playing devil’s advocate here
Feetfinders.com? Heh
That reminds me, I might have to put in a formal complaint for a somewhat similar matter.
Bought concert cards years ago, and was never able to unsubsribe from the newsletter. I sent requests to every mail address I could find, and never even got a response. Still got newsletters every now and then though.
They also just make it unnecessarily hard to contact them, so at this point I’m not sure my messages even reached them, which hopefully is what explains their failure to comply.
Depending on country there’s probably some regulator office which you can send a complaint to
Genuine question: Aren’t you supposed to say “this is not legal advice?” if you identify yourself as a lawyer but you’re not their legal council? Or am I mistaken?
Look it is the internet, you can rest assured if they say they are a lawyer, then there is no doubt ;)
That one is certainly illegal, misrepresenting yourself as a lawyer online and giving legal advice on that basis. Same for doctors.
Name and shame the company
expired
Man, Elon really does ruin everything. Can’t even use X as a variable anymore without a disclaimer.
How about using a programmer style variables like badCompanyName. You don’t have to be a mathematician. Sure, I can totally appreciate concise names, but some times you have to use longer names to avoid collisions.
Too true.
There is some arguement to be made that Facebook was kind of good at first. It was useful and it had social impacts that were positive. Over time it became toxic.
Twitter was awful from day one though, mostly because it was bloody useless from day one. Everything that anybody used it for could have been done, and generally was also done, on Facebook, so there was literally no point in the platform.
It’s new name is “X, formally known as Twitter”. Which is what every news website on the planet calls it.
Regardless the fact that X is a stupid name for a company, it’s also dumb to rename a popular company generally anyway.
No. They are obligated to obey the law as written. They don’t get to create conditions.
GDPR clearly states you can contact any part of the organisation with your request. You can make your request verbally or in writing and they must acknowledge it. They can’t refuse and make you use their app.
For fun send them a Subject Access Request and if they don’t acknowledge it, report them to the ICO (if you’re in the UK)
