4 ms·

The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self-propaganda. Th

by dnomad 8y ago

The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self-propaganda. The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. The SARs have clear, well-defined limits [1] and the response can and should be automated (once identity has been verified). [1] https://ico.org.uk/media/for-organisations/documents/2014223.. https://ico.org.uk/media/for-organisations/documents/2014223....

czardoz 8y ago
> The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. Why is this silly? Does the law explicitly forbid people from asking stuff like this?
- JumpCrisscross 8y ago
  > Does the law explicitly forbid people from asking stuff like this? No. The expectation is each of the EU’s twenty-eight national data regulators will be nice and reasonable into perpetuity.
- TheCoelacanth 8y ago
  Anyone is allowed for ask for anything. In context, they are clearly talking about which requests you are required to answer.
jacquesm 8y ago
In a legitimate - not trolling - exchange I could see a situation where asking about back-up policies is valid. For instance, a company could have had a breach where backups were involved. But the letter has been carefully worded as a DSAR, a Data Subject Access Request and throws in some cover in terms of concerns the user might legitimately have. So you can't just ignore this letter. The safe guards question would be valid in that context as well but not right of the bat in a first exchange, but if a previous answer left something specific unsaid. The location of the servers is a valid request depending on the context, for instance when the data is sufficiently critical to be legally mandated that it stays within the EU (yes, there is such data). Agreed on the automated response, that's the best way to handle this. Again, this is a troll letter, but even so it still requires a response otherwise you give the claimant grounds for forwarding their complaint to the regulators (who likely will ignore it but I'd play it safe).

by dnomad 8y ago

czardoz 8y ago

> The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. Why is this silly? Does the law explicitly forbid people from asking stuff like this?

JumpCrisscross 8y ago
> Does the law explicitly forbid people from asking stuff like this? No. The expectation is each of the EU’s twenty-eight national data regulators will be nice and reasonable into perpetuity.
TheCoelacanth 8y ago
Anyone is allowed for ask for anything. In context, they are clearly talking about which requests you are required to answer.

jacquesm 8y ago

In a legitimate - not trolling - exchange I could see a situation where asking about back-up policies is valid. For instance, a company could have had a breach where backups were involved. But the letter has been carefully worded as a DSAR, a Data Subject Access Request and throws in some cover in terms of concerns the user might legitimately have. So you can't just ignore this letter. The safe guards question would be valid in that context as well but not right of the bat in a first exchange, but if a previous answer left something specific unsaid. The location of the servers is a valid request depending on the context, for instance when the data is sufficiently critical to be legally mandated that it stays within the EU (yes, there is such data). Agreed on the automated response, that's the best way to handle this. Again, this is a troll letter, but even so it still requires a response otherwise you give the claimant grounds for forwarding their complaint to the regulators (who likely will ignore it but I'd play it safe).