6 ms·

And then somebody emails you with a request to all of their data you have on them. Now you must respond to this email and you must figure out a way to find out

And then somebody emails you with a request to all of their data you have on them. Now you must respond to this email and you must figure out a way to find out whether they are who they say they are. Then you have to either refuse the request or extract the data and send it to them. Now repeat this x amount of times depending on how many people want to mess with you at the time. What happens when spambots start using these requests?

pbhjpbhj 6y ago
If you find it hard to do that (have a defined way to recognise a customer; make a db lookup to get their data) then it's very simple you don't acquire nor keep that data. This means you have to have a level of competence - across your organisation (including how you store, retrieve data, and how you recognise customers) - before you start storing their data. Really if you can't established a way to recognise customers how can we (as customers) expect you to competently do 2FA and competently store data without losing it. It's like complaining that your kitchen shouldn't have to keep track of expiry dates of meat; if that's too onerous for you then you're showing you're not competent to run a kitchen.
- jessaustin 6y ago
  ISTM the system you describe could lead to more data collection. I.e., a site like HN knows emails, pseudonyms, and posting history. What if they got a request like this from someone who claimed not to have access to the email they used to sign up? HN couldn't possibly comply. Maybe that doesn't matter because posting history is public. One could easily envision another site that had some non-public data associated with email address, pseudonym, and no other PII. That site definitely violates the requirements you describe.
  - pilsetnieks 6y ago
    > What if they got a request like this from someone who claimed not to have access to the email they used to sign up? HN couldn't possibly comply They wouldn't have to. If you're requesting your data from a company, you have to burden of proof that you are in fact the person about whom you're requesting the data. If you cannot prove it, you cannot get the data.
  - wlll 6y ago
    You are allowed to require proof of identity before you hand out data. That might be as simple as requiring someone to log into their account (as you can already do on HN) to sending them a confirmation email, or other. > What if they got a request like this from someone who claimed not to have access to the email they used to sign up? HN couldn't possibly comply. No, and nor should they. > One could easily envision another site that had some non-public data associated with email address, pseudonym, and no other PII. "Dear requester, please log into you account and use the "request my data" link on your account page" There's a few things written about this around the web: https://law.stackexchange.com/questions/28998/right-of-access-by-the-data-subject-if-the-ip-address-is-the-only-personal-dat https://law.stackexchange.com/questions/28998/right-of-acces... > ISTM the system you describe could lead to more data collection. It really doesn't. What it does is attempt to gatekeep data (which these days is a huge risk) collection to organisations that are competent. You always have the option of not collecting data if you don't want to take that responsibility.
- Aerroon 6y ago
  >Really if you can't established a way to recognise customers how can we (as customers) expect you to competently do 2FA and competently store data without losing it. This is an insanely hard problem to do well. The recognition of customers is literally through which phishing attacks work. This is one of the most common avenues that people get access to systems and data they shouldn't. GDPR mandates that virtually every site needs to deal with this problem now. Also, I'd say that reprieving all data on someone is not a trivial problem. Imagine you had a forum and somebody requests all of the data on them. However, another user has made a copy elsewhere on the forum with some notes about that user's personal data. Does the requester get access to that copy? And now keep in mind that you complying is based on your understanding of a regulation that companies have spent millions on lawyers to figure out and still aren't entirely sure. And you have to follow this regardless how big or small your website or business is.
  - disgruntledphd2 6y ago
    It's best effort. No regulator is going to fine you massively if you miss some data in an edge case like this. Worst case scenario, they'll tell you to do better in future. I do see your point though, the intersection with phishing attacks is not something I'd considered in the context of GDPR. However, as long as you provide a way for users with an account to download their data, you're 90% of the way towards compliance. Again, unless you are FB or Google, the regulators will cut you some slack (just look at the lack of bankruptcies caused by GDPR).
    - strken 6y ago
      Unless the text of the law is "the company shall try very hard (but if they miss a weird edge case they shall be merely sent a warning letter)", the GDPR allows selective enforcement. You note that it's already one rule for FB and Google, another for smaller companies. To what extent do you trust the courts to selectively apply the law in a sensible way, vs selectively applying the law in a harmful but legal way?
      - disgruntledphd2 6y ago

pbhjpbhj 6y ago

If you find it hard to do that (have a defined way to recognise a customer; make a db lookup to get their data) then it's very simple you don't acquire nor keep that data. This means you have to have a level of competence - across your organisation (including how you store, retrieve data, and how you recognise customers) - before you start storing their data. Really if you can't established a way to recognise customers how can we (as customers) expect you to competently do 2FA and competently store data without losing it. It's like complaining that your kitchen shouldn't have to keep track of expiry dates of meat; if that's too onerous for you then you're showing you're not competent to run a kitchen.

jessaustin 6y ago
ISTM the system you describe could lead to more data collection. I.e., a site like HN knows emails, pseudonyms, and posting history. What if they got a request like this from someone who claimed not to have access to the email they used to sign up? HN couldn't possibly comply. Maybe that doesn't matter because posting history is public. One could easily envision another site that had some non-public data associated with email address, pseudonym, and no other PII. That site definitely violates the requirements you describe.
- pilsetnieks 6y ago
  > What if they got a request like this from someone who claimed not to have access to the email they used to sign up? HN couldn't possibly comply They wouldn't have to. If you're requesting your data from a company, you have to burden of proof that you are in fact the person about whom you're requesting the data. If you cannot prove it, you cannot get the data.
- wlll 6y ago
  You are allowed to require proof of identity before you hand out data. That might be as simple as requiring someone to log into their account (as you can already do on HN) to sending them a confirmation email, or other. > What if they got a request like this from someone who claimed not to have access to the email they used to sign up? HN couldn't possibly comply. No, and nor should they. > One could easily envision another site that had some non-public data associated with email address, pseudonym, and no other PII. "Dear requester, please log into you account and use the "request my data" link on your account page" There's a few things written about this around the web: https://law.stackexchange.com/questions/28998/right-of-access-by-the-data-subject-if-the-ip-address-is-the-only-personal-dat https://law.stackexchange.com/questions/28998/right-of-acces... > ISTM the system you describe could lead to more data collection. It really doesn't. What it does is attempt to gatekeep data (which these days is a huge risk) collection to organisations that are competent. You always have the option of not collecting data if you don't want to take that responsibility.
Aerroon 6y ago
>Really if you can't established a way to recognise customers how can we (as customers) expect you to competently do 2FA and competently store data without losing it. This is an insanely hard problem to do well. The recognition of customers is literally through which phishing attacks work. This is one of the most common avenues that people get access to systems and data they shouldn't. GDPR mandates that virtually every site needs to deal with this problem now. Also, I'd say that reprieving all data on someone is not a trivial problem. Imagine you had a forum and somebody requests all of the data on them. However, another user has made a copy elsewhere on the forum with some notes about that user's personal data. Does the requester get access to that copy? And now keep in mind that you complying is based on your understanding of a regulation that companies have spent millions on lawyers to figure out and still aren't entirely sure. And you have to follow this regardless how big or small your website or business is.
- disgruntledphd2 6y ago
  It's best effort. No regulator is going to fine you massively if you miss some data in an edge case like this. Worst case scenario, they'll tell you to do better in future. I do see your point though, the intersection with phishing attacks is not something I'd considered in the context of GDPR. However, as long as you provide a way for users with an account to download their data, you're 90% of the way towards compliance. Again, unless you are FB or Google, the regulators will cut you some slack (just look at the lack of bankruptcies caused by GDPR).
  - strken 6y ago
    Unless the text of the law is "the company shall try very hard (but if they miss a weird edge case they shall be merely sent a warning letter)", the GDPR allows selective enforcement. You note that it's already one rule for FB and Google, another for smaller companies. To what extent do you trust the courts to selectively apply the law in a sensible way, vs selectively applying the law in a harmful but legal way?
    - disgruntledphd2 6y ago