4 ms·

It's bizarre to me that anyone would respond to what would surmount to a legal request which was delivered via email. Unless the gov has a supeona that was ver

It's bizarre to me that anyone would respond to what would surmount to a legal request which was delivered via email. Unless the gov has a supeona that was verifiably delivered to me physically, an email will be either totally ignored, or I'll respond telling them to go pound sand.

dahfizz 5y ago
Is that how you would respond to any GDPR-related request? GDPR legally requires you to respond to requests within a month. If someone making a request points that out to you, you may feel like you've been threatened. That doesn't change the law.
- hellojesus 5y ago
  Yes, that is how I would respond to a request inquiring as to what my GDPR practices are. The requestor here isn't asking for access their information for GDPR reasons. They are asking what my private business operations are, which are not part of what I'm required to disclose, so far as my understanding goes. Separate from the above, if I run a US based business, why would I care if the EU wanted to try and sue me for breaking a law that has no jurisdiction over me?
- astura 5y ago
  >GDPR legally requires you to respond to requests within a month GDPR requires nothing of me, I don't live in Europe or do business with anyone who does. Anyways, this email wasn't a request for data, it's an inquiry about business practices.
jhgb 5y ago
As per the law, a GDPR data access request may be sent by e-mail, or even delivered verbally. So the form is actually irrelevant.
- hellojesus 5y ago
  Yes, but the researchers aren't asking about their data. They are asking about internal business policies, which they are not granted under the law. From the OP's links's FAQ: """ Why does this study involve contacting websites? Very few websites post details of their processes for handling GDPR and CCPA requests. Both the GDPR and the CCPA contemplate users and intermediaries reaching out with questions about data rights processes, and we are using that opportunity to understand current website policies and practices. """ From the sites I've seen discussing responsibilities, internal business processes for how GDPR requests are handled are not covered under GDPR. https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/gdpr-compliance?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/admin/securit... """ Data subject rights The GDPR establishes data subject rights, which means that, with respect to their personal data, customers, employees, business partners, clients, contractors, students, suppliers, and so forth have the right to: Be informed about their data: You must inform individuals about your use of their data. Have access to their data: You must give individuals access to any of their data that you hold (for example, by using account access or in some manual manner). Ask for data rectification: Individuals can ask you to correct inaccurate data. Ask for data to be deleted: Also known as the 'right to erasure', this right allows an individual to request that any of their personal data a company has collected is deleted across all systems that use it or share it. Request restricted processing: An individual can ask that you suppress or restrict their data. However, it is only applicable under certain circumstances. Have data portability: An individual can ask for their data to be transferred to another company. Object: An individual can object to their data being used for various uses including direct marketing. Ask not to be subject to automated decision-making, including profiling: The GDPR has strict rules about using data to profile people and automate decisions based on that profiling. """
  - jhgb 5y ago
    I was referring purely to the "Why would anyone respond to an e-mail" part -- because there's no requirement for such a request to not be an e-mail for it to be valid.
    - hellojesus 5y ago

dahfizz 5y ago

Is that how you would respond to any GDPR-related request? GDPR legally requires you to respond to requests within a month. If someone making a request points that out to you, you may feel like you've been threatened. That doesn't change the law.

hellojesus 5y ago
Yes, that is how I would respond to a request inquiring as to what my GDPR practices are. The requestor here isn't asking for access their information for GDPR reasons. They are asking what my private business operations are, which are not part of what I'm required to disclose, so far as my understanding goes. Separate from the above, if I run a US based business, why would I care if the EU wanted to try and sue me for breaking a law that has no jurisdiction over me?
astura 5y ago
>GDPR legally requires you to respond to requests within a month GDPR requires nothing of me, I don't live in Europe or do business with anyone who does. Anyways, this email wasn't a request for data, it's an inquiry about business practices.

jhgb 5y ago

As per the law, a GDPR data access request may be sent by e-mail, or even delivered verbally. So the form is actually irrelevant.

hellojesus 5y ago
Yes, but the researchers aren't asking about their data. They are asking about internal business policies, which they are not granted under the law. From the OP's links's FAQ: """ Why does this study involve contacting websites? Very few websites post details of their processes for handling GDPR and CCPA requests. Both the GDPR and the CCPA contemplate users and intermediaries reaching out with questions about data rights processes, and we are using that opportunity to understand current website policies and practices. """ From the sites I've seen discussing responsibilities, internal business processes for how GDPR requests are handled are not covered under GDPR. https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/gdpr-compliance?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/admin/securit... """ Data subject rights The GDPR establishes data subject rights, which means that, with respect to their personal data, customers, employees, business partners, clients, contractors, students, suppliers, and so forth have the right to: Be informed about their data: You must inform individuals about your use of their data. Have access to their data: You must give individuals access to any of their data that you hold (for example, by using account access or in some manual manner). Ask for data rectification: Individuals can ask you to correct inaccurate data. Ask for data to be deleted: Also known as the 'right to erasure', this right allows an individual to request that any of their personal data a company has collected is deleted across all systems that use it or share it. Request restricted processing: An individual can ask that you suppress or restrict their data. However, it is only applicable under certain circumstances. Have data portability: An individual can ask for their data to be transferred to another company. Object: An individual can object to their data being used for various uses including direct marketing. Ask not to be subject to automated decision-making, including profiling: The GDPR has strict rules about using data to profile people and automate decisions based on that profiling. """
- jhgb 5y ago
  I was referring purely to the "Why would anyone respond to an e-mail" part -- because there's no requirement for such a request to not be an e-mail for it to be valid.
  - hellojesus 5y ago