3 ms·

You know the concept of FUD. We saw it many times before. Please take a look at the full enforcement process: https://ec.europa.eu/commission/sites/beta-polit

You know the concept of FUD. We saw it many times before. Please take a look at the full enforcement process: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... You don't have to take my word for it, this is not legal counsel, it is just reading the law before jumping to extreme conclusions.

jacquesm 8y ago
I'll happily bet that I spent more time reading the GDPR than you did (such as: for the last year as a part of my day job) and you are spreading some pretty dangerous information in this thread up to and including telling people to ignore legitimate requests under the law. If you give out that kind of advise and in such an unqualified manner you should not then follow up by saying that 'this is not legal counsel'. A DSAR is a legitimate request under the law if you feel that this particular letter is not a legitimate request then you should address that with specifics.
- ainiriand 8y ago
  Do you think that a request from a user to access backup data is legitimate? If so, please take another read at the user's rights: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
  - jacquesm 8y ago
    The user made no request to access backup data, I don't know where you got that but it was not in the letter. The user requested to know if there were backups and if so how they are handled, which is a perfectly legitimate question, if only because quite a few breaches start with 'we've lost a backup and it wasn't encrypted'. This could - but does not necessarily - fall under 'other supplementary information' but would require more context. see: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Now, some of the requests in the letter are over the top but there is no harm in answering them. Not answering the whole letter is extremely dumb because you can't ignore a legitimate request because it asks for one thing that is not legitimate. Then you should just answer the remainder and lay out your reasons for not wanting to answer the questions you feel are not within the scope of such a request.
virgilp 8y ago
Well, for the full enforcement process: if your answer is not satisfactory, I will forward my letter (together with the notice of non-answer, or the notice of unsatisfactory answer) to my national data protection agency. Believe it or not, it's just an email. From there on, you have bureaucrats (who are paid for this & motivated to write fines) that will take up the legal process. The whole setup is similar to the consumer protection agency - and I hardly ever have to do anything after notifying that agency, I just receive a later with the resolution after a few months.
- ainiriand 8y ago
  Fines are just the last resort. There are many mechanisms that the DPA office can take. Take a look at the user's rights here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/what-are-my-rights_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... As you can see, the letter clearly extralimitates the user's rights. So you can forward as many letters as you want but that's not gonna work.
  - virgilp 8y ago
    Depends on what you mean but "not gonna work". I presume that all my questions will have satisfactory answers, either directly by the company or via the DPA. Either way, it's just an email for me. I'm pretty sure it's more than "just an email" for someone who does business in the EU but chooses to ignore my original request.

jacquesm 8y ago

I'll happily bet that I spent more time reading the GDPR than you did (such as: for the last year as a part of my day job) and you are spreading some pretty dangerous information in this thread up to and including telling people to ignore legitimate requests under the law. If you give out that kind of advise and in such an unqualified manner you should not then follow up by saying that 'this is not legal counsel'. A DSAR is a legitimate request under the law if you feel that this particular letter is not a legitimate request then you should address that with specifics.

ainiriand 8y ago
Do you think that a request from a user to access backup data is legitimate? If so, please take another read at the user's rights: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- jacquesm 8y ago
  The user made no request to access backup data, I don't know where you got that but it was not in the letter. The user requested to know if there were backups and if so how they are handled, which is a perfectly legitimate question, if only because quite a few breaches start with 'we've lost a backup and it wasn't encrypted'. This could - but does not necessarily - fall under 'other supplementary information' but would require more context. see: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Now, some of the requests in the letter are over the top but there is no harm in answering them. Not answering the whole letter is extremely dumb because you can't ignore a legitimate request because it asks for one thing that is not legitimate. Then you should just answer the remainder and lay out your reasons for not wanting to answer the questions you feel are not within the scope of such a request.

virgilp 8y ago

Well, for the full enforcement process: if your answer is not satisfactory, I will forward my letter (together with the notice of non-answer, or the notice of unsatisfactory answer) to my national data protection agency. Believe it or not, it's just an email. From there on, you have bureaucrats (who are paid for this & motivated to write fines) that will take up the legal process. The whole setup is similar to the consumer protection agency - and I hardly ever have to do anything after notifying that agency, I just receive a later with the resolution after a few months.

ainiriand 8y ago
Fines are just the last resort. There are many mechanisms that the DPA office can take. Take a look at the user's rights here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/what-are-my-rights_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... As you can see, the letter clearly extralimitates the user's rights. So you can forward as many letters as you want but that's not gonna work.
- virgilp 8y ago
  Depends on what you mean but "not gonna work". I presume that all my questions will have satisfactory answers, either directly by the company or via the DPA. Either way, it's just an email for me. I'm pretty sure it's more than "just an email" for someone who does business in the EU but chooses to ignore my original request.