4 ms·

What's interesting, and pointed out by a Reddit comment: https://www.reddit.com/r/legaladvice/comments/acsdf3/comment/eddcc3u https://www.reddit.com/r/legaladvi

What's interesting, and pointed out by a Reddit comment: https://www.reddit.com/r/legaladvice/comments/acsdf3/comment/eddcc3u https://www.reddit.com/r/legaladvice/comments/acsdf3/comment... There's no way to identify that the person making the request is who he/she says he/she is. The irony is that for services like Facebook, Facebook could ask for a scan of your id/passport to confirm it's you, (and would it also have to keep that scan saved somewhere in case it later needs to prove that it "authenticated" the gdpr request correctly?) But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?!

a_imho 8y ago
The authentication scheme should be the same that is used for signup e.g. email.
icebraining 8y ago
Doesn't Even have some sort of user profile? Bob could update it saying "yes, I made a GDPR request to X on date Y".
- fhrow4484 8y ago
  That's true, here it could be sufficient.
entity345 8y ago
This right of access to your personal data has existed in the EU for 20 years. This is not new. And yes, there is a need to verify IDs. Most companies don't have online forms for this so the way has always been to send an email and enquire, or to write on paper with a copy of a valid ID. This is not new. The question is whether data submitted under a pseudonym (e.g. forum activity) are actually personal information by law since the individual cannot be identified.
geocar 8y ago
> But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?! That's one way to do it. Another way would be to ask them to log in and set some preference (change their info field or name to "DELETE ME") or something like that.
jinglebells 8y ago
Isn't this solved by making "Delete My Account" a self-service button on the user account page? It really should be automated anyway. PII for billing and contractual reasons isn't covered by the right to be forgotten (as I read the regulations) because they're required for other legal reasons.

a_imho 8y ago

The authentication scheme should be the same that is used for signup e.g. email.

icebraining 8y ago

Doesn't Even have some sort of user profile? Bob could update it saying "yes, I made a GDPR request to X on date Y".

fhrow4484 8y ago
That's true, here it could be sufficient.

entity345 8y ago

This right of access to your personal data has existed in the EU for 20 years. This is not new. And yes, there is a need to verify IDs. Most companies don't have online forms for this so the way has always been to send an email and enquire, or to write on paper with a copy of a valid ID. This is not new. The question is whether data submitted under a pseudonym (e.g. forum activity) are actually personal information by law since the individual cannot be identified.

geocar 8y ago

> But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?! That's one way to do it. Another way would be to ask them to log in and set some preference (change their info field or name to "DELETE ME") or something like that.

jinglebells 8y ago

Isn't this solved by making "Delete My Account" a self-service button on the user account page? It really should be automated anyway. PII for billing and contractual reasons isn't covered by the right to be forgotten (as I read the regulations) because they're required for other legal reasons.