4 ms·

I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expect

by gnode 8y ago

I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expectation of customers and prospective customers (Europeans at least).

jacquesm 8y ago
You can probe for GDPR compliance without inflicting a large amount of work on the counterparty, assuming that you are on friendly terms. For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'. To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.
- fotbr 8y ago
  That request gets vague promises, with no proof that the entity is following through with them. Asking for the maximum shows you exactly how compliant an entity is.
  - jacquesm 8y ago
    No, that request should get you some fairly precise answers. If the answers are unsatisfactory then you always have the option to escalate, and it will actually help you if you do in the end decide to lodge a complaint with the regulators. As it stands it's clearly an attempt at causing the wheels to grind to a halt, the title of the request and the context in which it has been presented are evidence of that as is the faux concern laced through the letter. This is not a request made in good faith.
- mlthoughts2018 8y ago
  In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. It that case, I want to know about all the data that company has regarding me, and how they got it. Most likely I also want them to delete it too. Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
  - jacquesm 8y ago
    > In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. Agreed, but that's not the letter writers goal. > It that case, I want to know about all the data that company has regarding me, and how they got it. Agreed. > Most likely I also want them to delete it too. No, you absolutely want them to delete it, and besides that to tell you if they passed it on. > Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). Yes, but the letter writer is by their own admission not in that situation, they're a customer of the company, so a direct relationship between them and the company exists, which most likely was initiated by the letter writer. > And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. Agreed, but again, that is not the context. > I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. No, it will be used for trolling, in fact it already is being used for trolling. And that's a net negative, which if enough idiots do it will cause the GDPR to be devalued to the point where it is no longer very useful. > In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests. That's the whole problem isn't it? Check the context in which the original letter (see link in article) is presented. It's a clear example of trolling.
    - mlthoughts2018 8y ago
      I think you’re focusing way too much on the fact that the template is written from the perspective of an existing customer. On reading the template, it seems super obvious that it doesn’t assume a goal of only being applied to situations when you’re already a highly engaged customer. Things might be on a spectrum. I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account. It would be fine to call myself “an existing customer” in that case, even though my connection to the company is not like a vigorous customer relationship with a company whose services I use all the time. That’s just a common idiom, very clearly not intended to mean the template is intended for spamming around to every big box company you’ve ever engaged with or something. You can write, “I’m your customer,” while still feeling that you don’t trust that company and what your request for a comprehensive overview of how they use your data to be taken seriously (hence the template’s value).
- gnode 8y ago
  I agree that the letter could be written in a less threatening manner, but the specific questions are required, in my opinion. If you ask someone whether they are complying with the law, you're likely to just get an inconsiderate "yes", with no indication they even understand the law (there is certainly plenty of misunderstanding that I have seen already, from companies large and small). Making specific questions about their business practises, such that they will have to plainly lie in order maintain a false claim of compliance is more rigorous.
  - jacquesm 8y ago
    I would use that strategy only in a situation where the relationship is already adversarial or where some distrust is warranted. But different strokes for different folks, of course everybody is free to do what they want. But then you should be aware that a torrent of these requests are not going to help make matters better, they will just cause people to tune out and regulators to stop taking the complaints serious. It's like bringing a chainsaw to a surgery.
    - delecti 8y ago
      > or where some distrust is warranted There have been enough data breaches that distrust is always warranted when a company has my data.
      - jacquesm 8y ago
        It saddens me to confirm that your viewpoint is backed up by my day to day experience looking at companies from the other side. But, and this is important, not every company sucks at this, I'd say it's about 70/30 at the moment (substantially improved from 3 years ago) when it comes to doing things right. That 30% is of course way too low but it was so much worse that that's already quite a step. This too depends very much on the company activity.
        delecti 8y ago
        Even the companies that don't suck at it are still putting me at risk just by possessing my information. In the risk analysis, it's not that the chances of something happening are necessarily high, it's that the potential damage is high.
detaro 8y ago
For a basic probe, I'd just ask for general information, e.g. the documentation of what user data they process with what justification. Compliant orgs can likely just respond with a PDF they've prepared, you can review that and if something seems odd or interesting or not matching what you see ask detailed questions later, or request specific information about your account. (Also easier for you, since the initial response doesn't require verifying your identity) If they can't give a convincing answer, then bigger guns are appropriate.

by gnode 8y ago

jacquesm 8y ago

You can probe for GDPR compliance without inflicting a large amount of work on the counterparty, assuming that you are on friendly terms. For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'. To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.

fotbr 8y ago
That request gets vague promises, with no proof that the entity is following through with them. Asking for the maximum shows you exactly how compliant an entity is.
- jacquesm 8y ago
  No, that request should get you some fairly precise answers. If the answers are unsatisfactory then you always have the option to escalate, and it will actually help you if you do in the end decide to lodge a complaint with the regulators. As it stands it's clearly an attempt at causing the wheels to grind to a halt, the title of the request and the context in which it has been presented are evidence of that as is the faux concern laced through the letter. This is not a request made in good faith.
mlthoughts2018 8y ago
In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. It that case, I want to know about all the data that company has regarding me, and how they got it. Most likely I also want them to delete it too. Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
- jacquesm 8y ago
  > In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. Agreed, but that's not the letter writers goal. > It that case, I want to know about all the data that company has regarding me, and how they got it. Agreed. > Most likely I also want them to delete it too. No, you absolutely want them to delete it, and besides that to tell you if they passed it on. > Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). Yes, but the letter writer is by their own admission not in that situation, they're a customer of the company, so a direct relationship between them and the company exists, which most likely was initiated by the letter writer. > And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. Agreed, but again, that is not the context. > I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. No, it will be used for trolling, in fact it already is being used for trolling. And that's a net negative, which if enough idiots do it will cause the GDPR to be devalued to the point where it is no longer very useful. > In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests. That's the whole problem isn't it? Check the context in which the original letter (see link in article) is presented. It's a clear example of trolling.
  - mlthoughts2018 8y ago
    I think you’re focusing way too much on the fact that the template is written from the perspective of an existing customer. On reading the template, it seems super obvious that it doesn’t assume a goal of only being applied to situations when you’re already a highly engaged customer. Things might be on a spectrum. I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account. It would be fine to call myself “an existing customer” in that case, even though my connection to the company is not like a vigorous customer relationship with a company whose services I use all the time. That’s just a common idiom, very clearly not intended to mean the template is intended for spamming around to every big box company you’ve ever engaged with or something. You can write, “I’m your customer,” while still feeling that you don’t trust that company and what your request for a comprehensive overview of how they use your data to be taken seriously (hence the template’s value).
gnode 8y ago
I agree that the letter could be written in a less threatening manner, but the specific questions are required, in my opinion. If you ask someone whether they are complying with the law, you're likely to just get an inconsiderate "yes", with no indication they even understand the law (there is certainly plenty of misunderstanding that I have seen already, from companies large and small). Making specific questions about their business practises, such that they will have to plainly lie in order maintain a false claim of compliance is more rigorous.
- jacquesm 8y ago
  I would use that strategy only in a situation where the relationship is already adversarial or where some distrust is warranted. But different strokes for different folks, of course everybody is free to do what they want. But then you should be aware that a torrent of these requests are not going to help make matters better, they will just cause people to tune out and regulators to stop taking the complaints serious. It's like bringing a chainsaw to a surgery.
  - delecti 8y ago
    > or where some distrust is warranted There have been enough data breaches that distrust is always warranted when a company has my data.
    - jacquesm 8y ago
      It saddens me to confirm that your viewpoint is backed up by my day to day experience looking at companies from the other side. But, and this is important, not every company sucks at this, I'd say it's about 70/30 at the moment (substantially improved from 3 years ago) when it comes to doing things right. That 30% is of course way too low but it was so much worse that that's already quite a step. This too depends very much on the company activity.
      - delecti 8y ago
        Even the companies that don't suck at it are still putting me at risk just by possessing my information. In the risk analysis, it's not that the chances of something happening are necessarily high, it's that the potential damage is high.

detaro 8y ago

For a basic probe, I'd just ask for general information, e.g. the documentation of what user data they process with what justification. Compliant orgs can likely just respond with a PDF they've prepared, you can review that and if something seems odd or interesting or not matching what you see ask detailed questions later, or request specific information about your account. (Also easier for you, since the initial response doesn't require verifying your identity) If they can't give a convincing answer, then bigger guns are appropriate.