2 ms·

In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional

by mlthoughts2018 8y ago

In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. It that case, I want to know about all the data that company has regarding me, and how they got it. Most likely I also want them to delete it too. Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.

jacquesm 8y ago
> In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. Agreed, but that's not the letter writers goal. > It that case, I want to know about all the data that company has regarding me, and how they got it. Agreed. > Most likely I also want them to delete it too. No, you absolutely want them to delete it, and besides that to tell you if they passed it on. > Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). Yes, but the letter writer is by their own admission not in that situation, they're a customer of the company, so a direct relationship between them and the company exists, which most likely was initiated by the letter writer. > And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. Agreed, but again, that is not the context. > I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. No, it will be used for trolling, in fact it already is being used for trolling. And that's a net negative, which if enough idiots do it will cause the GDPR to be devalued to the point where it is no longer very useful. > In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests. That's the whole problem isn't it? Check the context in which the original letter (see link in article) is presented. It's a clear example of trolling.
- mlthoughts2018 8y ago
  I think you’re focusing way too much on the fact that the template is written from the perspective of an existing customer. On reading the template, it seems super obvious that it doesn’t assume a goal of only being applied to situations when you’re already a highly engaged customer. Things might be on a spectrum. I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account. It would be fine to call myself “an existing customer” in that case, even though my connection to the company is not like a vigorous customer relationship with a company whose services I use all the time. That’s just a common idiom, very clearly not intended to mean the template is intended for spamming around to every big box company you’ve ever engaged with or something. You can write, “I’m your customer,” while still feeling that you don’t trust that company and what your request for a comprehensive overview of how they use your data to be taken seriously (hence the template’s value).
  - jacquesm 8y ago
    > I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account. In that case it looks like the burden lies with you, not with the company and to send a letter like this in that context would be total overkill. I'd start off with a simple request to remove my data.
    - mlthoughts2018 8y ago
      But I would be worried about what data they collected, and who they might have sold it to, even if they had never yet done anything suspicious or wrong directly towards me. Another way to put it is: I’m generally deeply mistrusting of corporate entities collecting my data at all — even very upstanding corporate entities — and believe basic prudence requires me to treat them all with skepticism about my data.

jacquesm 8y ago

> In some cases, like having received email communication from a business I’ve never used, never provided my email to, and never consented to receive promotional emails from, the situation starts out unfriendly from the very beginning. Agreed, but that's not the letter writers goal. > It that case, I want to know about all the data that company has regarding me, and how they got it. Agreed. > Most likely I also want them to delete it too. No, you absolutely want them to delete it, and besides that to tell you if they passed it on. > Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). Yes, but the letter writer is by their own admission not in that situation, they're a customer of the company, so a direct relationship between them and the company exists, which most likely was initiated by the letter writer. > And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy. Agreed, but again, that is not the context. > I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem. No, it will be used for trolling, in fact it already is being used for trolling. And that's a net negative, which if enough idiots do it will cause the GDPR to be devalued to the point where it is no longer very useful. > In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests. That's the whole problem isn't it? Check the context in which the original letter (see link in article) is presented. It's a clear example of trolling.

mlthoughts2018 8y ago
I think you’re focusing way too much on the fact that the template is written from the perspective of an existing customer. On reading the template, it seems super obvious that it doesn’t assume a goal of only being applied to situations when you’re already a highly engaged customer. Things might be on a spectrum. I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account. It would be fine to call myself “an existing customer” in that case, even though my connection to the company is not like a vigorous customer relationship with a company whose services I use all the time. That’s just a common idiom, very clearly not intended to mean the template is intended for spamming around to every big box company you’ve ever engaged with or something. You can write, “I’m your customer,” while still feeling that you don’t trust that company and what your request for a comprehensive overview of how they use your data to be taken seriously (hence the template’s value).
- jacquesm 8y ago
  > I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account. In that case it looks like the burden lies with you, not with the company and to send a letter like this in that context would be total overkill. I'd start off with a simple request to remove my data.
  - mlthoughts2018 8y ago
    But I would be worried about what data they collected, and who they might have sold it to, even if they had never yet done anything suspicious or wrong directly towards me. Another way to put it is: I’m generally deeply mistrusting of corporate entities collecting my data at all — even very upstanding corporate entities — and believe basic prudence requires me to treat them all with skepticism about my data.