A few days ago I sent a GDPR request to some company to delete my personal data. They said to install their app and send a ticket from the app. The email was sent from the email address to which the account is registered. Is this even legal?
No, it’s not at all legal for the company to do this. Reply and remind them they have one calendar month to comply from the date of your original request, otherwise you will make a complaint to which ever information regulator is correct for the juridiction they’re operating in.
I’m a lawyer specialising in Data Privacy, reply here if you need more help on this one.
Also feel free to name the company.
Fuck them and bless u lol
For now, I do not want to announce the name of this company publicly.
If they don't want to solve it amicably, then I will do so.
They already said they don't want to.
They asked you to install the app on purpose, in hopes that you'll decide it's too much hassle and decide not to delete the account.
This is a bad decision, IMO. They may fix it for you, but then you've lost the opportunity to assist everyone who comes after you.
You posted asking the public for help. Please return the favor and report them, as you are legally supposed to do.
Why not? That's so weird...
Think of the poor corporation! If they get punished for their illegal buisness practices, it'll hurt the economy and people will be less inclined to start a small buisness. Didn't you study piss down economics?
"WHAT ABOUT THE TRUE VICTIMS HERE! WHY DOESN'T ANYONE CARE ABOUT THOSE HARDWORKING, SALT-OF-THE-EARTH SHAREHOLDERS! ARE YOU PEOPLE FUCKING COMMUNISTS?!"
Must be something that makes you look bad lol
Otherwise you'd just say it. You owe them nothing and they've broken the fuckin law and you're protecting them? What do they have on you?
Or maybe they just want to disclose as little of their personal information, including services relied on, on an open platform like this. Idk if that's the case, but playing devil's advocate here
I will never understand why people complain online then do this. Why are you being such a pushover. What does amicably even mean to you?
Feetfinders.com? Heh
That reminds me, I might have to put in a formal complaint for a somewhat similar matter.
Bought concert cards years ago, and was never able to unsubsribe from the newsletter. I sent requests to every mail address I could find, and never even got a response. Still got newsletters every now and then though.
They also just make it unnecessarily hard to contact them, so at this point I'm not sure my messages even reached them, which hopefully is what explains their failure to comply.
expired
Man, Elon really does ruin everything. Can't even use X as a variable anymore without a disclaimer.
It's causing hell of problems to mathematicians worldwide.
Suddenly, every math formula ever written is subject to copyright and royalties.
Fuck that, I refuse to give him the letter. He can pry it from my cold dead hands as he chokes on my liver!
No. They are obligated to obey the law as written. They don’t get to create conditions.
GDPR clearly states you can contact any part of the organisation with your request. You can make your request verbally or in writing and they must acknowledge it. They can't refuse and make you use their app.
For fun send them a Subject Access Request and if they don't acknowledge it, report them to the ICO (if you're in the UK)
Name & shame.
Simply ask for the official company name, registration number and country as well as the prereree means of communication that they would like your local data authorities to contact them on.
Also make a 1 star review, stating that you are in talks with your local gdpr authorities about their way of handling privacy.
This worked for me last time a company asked me to download an app to delete my account
I had this before, though not through a direct communication. Someone had gotten my email credentials somehow and installed a company's app and made an account. When I went through the support pages on the company's site to find out how to delete the account the only listed way was through the app itself.
They were accommodating and helpful when I emailed the company about it though. I just told them that I can't agree to the privacy policy and thus cannot install the app but still need the account to be deleted. They did it.
It is absolutely not
They were very friendly imo. No need to speak legalese or to be rude.
Just tell them that you can't or don't want to install the app.
If they don't help you, then you proceed to remind them that you are not required to install anything for them to comply with GDPR.
Being friendly doesn't negate the fact that they are out of compliance with the law. Even sending a second email to insist they delete your data is an undue burden.
It's the bare minimum of friendliness expected in customer care. Most likely a macro which is normal with these kind of requests.
Time to speak corporate to them. Write out a GDPR removal demand letter. And mail it to them certified or whatever corporate mail does in your local jurisdiction.
I had a simmilar situation with Nicehash (crypto shit company), but I had 2fa enabled and just wanted to unsubscribe from useless newsletters. They asked for a photo of me holding a paper with my personal information. Still didnt solve that, but some comments here might help, following
eBay does this too. They told me they can't access my data to delete it, that I have to log in with their website or app and send information to just get my data, let alone have it deleted.
It's way too easy to spoof email "from" addresses.
There should be a way to do it through their website though. Requiring an app is just stupid.
They literally replied to his registered email and he has the reply. That would indicate that he has at least access to the account. So with OP's next email quoting the reply ownership over the associated email address should be reasonably established.
Their site is just a landing page, there's no login option or anything like that. Their business is a smartphone application.
Edit: Gmail uses SPF, DMARC and DKIM signing so spoofing is not possible if their email services are configured properly.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)