4 ms·

I wanted to get my data out of ask.fm because I answered quite a lot of questions there back when it was fun. The GDPR export option was nowhere to be found. Op

I wanted to get my data out of ask.fm because I answered quite a lot of questions there back when it was fun. The GDPR export option was nowhere to be found. Opened a support ticket, they asked me for a EU ID... Well, yeah, I don't have one, I'm not a EU resident, I wanted to piggyback on the laws of countries that actually care about their people. But it just struck me that they hate their users this much. Even Facebook didn't go this low. On an absolutely unrelated note, I reverse engineered ask.fm's client API back when I was actually using it.

wizzwizz4 5y ago
Under GDPR I think they're not allowed to require an EU ID. So just say “I'm not required to give you my personal data for this”.
- johndough 5y ago
  Do you have a source for this? In my experience, many large companies ask for ID. I am not quite sure which is correct since, on the one hand, they should verify that a request comes from the legitimate account holder, but on the other hand, they should practice data minimization.
  - grishka 5y ago
    > they should verify that a request comes from the legitimate account holder Facebook and Google do this by asking you to enter your password again. The ID thing is clearly there to impose a limit based on your nationality.
    - scrollaway 5y ago
      You can be an eu citizen with a non-eu ID so it makes no sense.
      - anticensor 5y ago
        How?
        scrollaway 5y ago
        If you have a right of permanent stay in the EU, you're a citizen, even if you're from a non eu country. If you have dual nationality between an eu and non eu country you might have two IDs as well. Lots of cases like these. I'd call them edge cases but they're really not.
  - sushibowl 5y ago
    I suppose this is a UK source but it should apply to GDPR generally https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/what-should-we-consider-when-responding-to-a-request/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > You should also not request formal identification documents unless necessary. First you should think about other reasonable and proportionate ways you can verify an individual’s identity. You may already have verification measures in place which you can use, for example a username and password. The GDPR doesn't state explicitly how to do identification for subject access requests, only that “The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.” In the case of ask.fm it seems like if the person's identity can be verified by the fact that they can access their account, it's not reasonable to require an official ID.
    - afiori 5y ago
      this is to regarding identification for grishka it was about proving if the law was applicable
- DocTomoe 5y ago
  Not identifying a data subject without beyond reasonable doubt before sending out highly personal data is itself a GDPR violation - even a data breach which they would have to report to their GDPR officer.
  - La1n 5y ago
    >beyond reasonable doubt Sure, but on a website log-in info, email confirmation or 2FA is enough for that. Unless you already gave them your ID-card, they shouldn't have to use that to identify you.
    - DocTomoe 5y ago
      I'm not sure about that. Information that is saved about a user might be more security-relevant than what someone - they or someone who hacked their account - might see in their account. It clearly is something I would not want to have hours of meetings with legal council about, so I can see why some organisations may err on the safer side.
      - PoignardAzur 5y ago
        You're playing devil's advocate. If someone has access to your password and 2FA method, they can impersonate you and destroy your reputation, buy things in your name, consult all your old photos and learn everything about you, etc, and no platform will ever ask them a EU id at any point in the process. The idea that a platform asks for a EU id for any reason other than making the GDPR request process more painful is laughable.
        afiori 5y ago
        there is a possible reason, the gdpr applies to EU citizens, EU residents, and people within the EU, so it is reasonable they ask you to prove you are one of these categories.
        PoignardAzur 5y ago
- mrweasel 5y ago
  What do they mean with an EU id? Passport, licens? Those have my CPR number (think SSN, but different). There no way I showing that to export a playlist. It’s suppose to be kept secret. If your company can’t respect the GDPR how am I to expect that you’ll safely handle the single most import personal information I have?

wizzwizz4 5y ago

Under GDPR I think they're not allowed to require an EU ID. So just say “I'm not required to give you my personal data for this”.

johndough 5y ago
Do you have a source for this? In my experience, many large companies ask for ID. I am not quite sure which is correct since, on the one hand, they should verify that a request comes from the legitimate account holder, but on the other hand, they should practice data minimization.
- grishka 5y ago
  > they should verify that a request comes from the legitimate account holder Facebook and Google do this by asking you to enter your password again. The ID thing is clearly there to impose a limit based on your nationality.
  - scrollaway 5y ago
    You can be an eu citizen with a non-eu ID so it makes no sense.
    - anticensor 5y ago
      How?
      - scrollaway 5y ago
        If you have a right of permanent stay in the EU, you're a citizen, even if you're from a non eu country. If you have dual nationality between an eu and non eu country you might have two IDs as well. Lots of cases like these. I'd call them edge cases but they're really not.
- sushibowl 5y ago
  I suppose this is a UK source but it should apply to GDPR generally https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/what-should-we-consider-when-responding-to-a-request/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > You should also not request formal identification documents unless necessary. First you should think about other reasonable and proportionate ways you can verify an individual’s identity. You may already have verification measures in place which you can use, for example a username and password. The GDPR doesn't state explicitly how to do identification for subject access requests, only that “The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.” In the case of ask.fm it seems like if the person's identity can be verified by the fact that they can access their account, it's not reasonable to require an official ID.
  - afiori 5y ago
    this is to regarding identification for grishka it was about proving if the law was applicable
DocTomoe 5y ago
Not identifying a data subject without beyond reasonable doubt before sending out highly personal data is itself a GDPR violation - even a data breach which they would have to report to their GDPR officer.
- La1n 5y ago
  >beyond reasonable doubt Sure, but on a website log-in info, email confirmation or 2FA is enough for that. Unless you already gave them your ID-card, they shouldn't have to use that to identify you.
  - DocTomoe 5y ago
    I'm not sure about that. Information that is saved about a user might be more security-relevant than what someone - they or someone who hacked their account - might see in their account. It clearly is something I would not want to have hours of meetings with legal council about, so I can see why some organisations may err on the safer side.
    - PoignardAzur 5y ago
      You're playing devil's advocate. If someone has access to your password and 2FA method, they can impersonate you and destroy your reputation, buy things in your name, consult all your old photos and learn everything about you, etc, and no platform will ever ask them a EU id at any point in the process. The idea that a platform asks for a EU id for any reason other than making the GDPR request process more painful is laughable.
      - afiori 5y ago
        there is a possible reason, the gdpr applies to EU citizens, EU residents, and people within the EU, so it is reasonable they ask you to prove you are one of these categories.
        PoignardAzur 5y ago
mrweasel 5y ago
What do they mean with an EU id? Passport, licens? Those have my CPR number (think SSN, but different). There no way I showing that to export a playlist. It’s suppose to be kept secret. If your company can’t respect the GDPR how am I to expect that you’ll safely handle the single most import personal information I have?