4 ms·

I have a general question about this. If you have a privacy policy which discusses (amongst other things) the answers to these questions, would it be sufficient

• jacquesm 8y ago
  In part this form letter seems to assume that all the burden is on the company, whereas if the company has already answered these questions in a public medium you could (1) take that as a signal that the claimant is a troll (otherwise they would have read your privacy policy) and (2) that they probably don't care about the answer, they're just looking for a reason to stir the pot, so any deficient answer will be used to contact the regulator. The best way to deal with that is to answer the request in detail (which makes it very unlikely that a regulator would follow up if there was a complaint) and to refer to public resources such as your privacy policy because that's something that indicates that the claimant didn't do their homework, which is something a regulator will use to weigh whether or not to follow up on the complaint.
  • arbuge 8y ago
    > The best way to deal with that is to answer the request in detail I keep hearing this but I think in reality the volume of troll requests will dictate whether that is practical or not for any given company. Small startups might have problems if that volume is not proportionately small.
    • jacquesm 8y ago
      The problem would be in answering just one of these, then the amount of effort would be disproportionately large. But to answer a whole bunch of them is a 'mere matter of programming' unless you've really made a mess of things.
      • arbuge 8y ago
        That assumes the trolls will all use the same form letter with no variations, which might not be the case.
• hjnilsson 8y ago
  Yes, that would be sufficient (if you also have a tool that lets the customer download and/or delete his own data).