Their reply to my request to delete my data:

Thank you for your email requesting your right to be forgotten.

In order for us to carry out this request, we require proof of ID to ensure we only action requests made by the genuine owner of this email account. Acceptable forms of identification are,

  • Recent utility bill from the last 3 months (e.g. Gas, Electric)
  • Valid drivers License
  • TV License within the last 12 months
  • Council Tax Letter within the last 12 months
  • Title Deeds
  • drre@feddit.de
    38·
    1 year ago

    i guess it’s related to the following; exercising your rights under gdpr requires the other party to be able to identify you. that’s why they need this information. if you want to (potentially) fuck with them: first ask for a listing of all the information they have about you, before asking for deleting your data. this listing must contain the request itself. if your request is missing, they are likely breaking compliance rules.

    • AdvicePleaseThankyou@kbin.socialOP
      13·
      1 year ago

      first ask for a listing of all the information they have about you, before asking for deleting your data. this listing must contain the request itself. if your request is missing, they are likely breaking compliance rules.

      I’m not quite understanding, do you mind breaking that down for me?

      • drre@feddit.de
        14·
        1 year ago

        one of your rights under gdpr is that you are entitled (free of charge) to a listing of all the data the other party has about you.

        when you ask them about this listing this request itself becomes data the party has about you. it should therefore he included in the listing. (it is self referential, but that’s how it is).

        if the information that you requested such a listing is missing from the data they provide in response to you request, they are in breach of gdpr rules. from them on you might want to file a complaint.

        ( I’ve no idea whether this would result in any meaningful compensation, if at all. but at least it should keep them busy.)

        • AdvicePleaseThankyou@kbin.socialOP
          6·
          1 year ago

          Thanks for clearing that up, definitely not looking for compensation or anything, just for my request for deletion to be respected, but adding something like that to a complaint would definitely help. Thanks!

      • Pollen Pirate@beehaw.org
        5·
        1 year ago

        The norms say after you requests it, they have 30 days to send you a successful deletion of your data or request done. After your request they have 30 days, I didn’t read anything about “validate” it’s you. Only 30 days to successfully delete it, and that is how it went when I did request it.

      • Piecemakers@lemmy.worldEnglish
        41·
        1 year ago

        1.) Ask for a listing of all the information they have about you.

        2.) If your aforementioned Deletion request (see title) is missing from that list, they are likely breaking compliance rules.

        3.) …

        4.) Profit!

          • drre@feddit.de
            3·
            1 year ago

            they they need to id you everytime you exercise your gdpr rights. there is nothing they can do about this.

            • AdvicePleaseThankyou@kbin.socialOP
              41·
              1 year ago

              That’s just not true, I’ve put through a ton of requests in the past, for companies that had much more sensitive data (like payment details) and have never been asked for ID.

                • AdvicePleaseThankyou@kbin.socialOP
                  4·
                  1 year ago

                  Which they can by asking me to confirm who I am from the information they already have, the whole point is that they’re demanding I provide additional documentation to prove my identity, which is complete overkill* and something that I have never come across, and shouldn’t have to comply with.

                  But either way, if they need my ID before they’ll provide my info, asking for it to try and catch them on a mistake only to be met by the same barrier (them demanding ID), it isn’t going to work…

                  *(My brain can’t deal with that document you linked right now, but the relevant governing body here (ICO) say “The organisation might need you to prove your identity. However, they should only ask you for just enough information to be sure you are the right person.”

        • drre@feddit.de
          02·
          1 year ago

          i doubt there is profit to be made. it’s more to keep them busy and learning about gdpr.