I does have teeth, but you need to be willing to sue the company to force removal. Data protection agencies are swamped with complaints so you have to take thin

I does have teeth, but you need to be willing to sue the company to force removal. Data protection agencies are swamped with complaints so you have to take things into your own hands. Article 79 opens up for civil action against data controllers that refuse to obey the GDPR. Data subjects can sue for compensation, but are probably not restricted to compensation. It's a reasonable interpretation of the GPDR that you can sue for deletion. At the very least your friend should submit a complaint to his country's data protection agency. In your case I absolutely think that you could have a valid claim for compensation. But the devil is in the detail. For example, on what legal basis is the company you interviewed with processing your data? On what basis is Pana processing it? If you're genuinely interested in trying to claim compensation you can reach out to me and I can give you some directions and reading tips. EDIT: IANAL, but I work with data protection questions.