9 ms·

As an EU citizen, do the following: Paste some information about yourself into one of these forms without submitting, then send them an e-mail asking them to de

As an EU citizen, do the following: Paste some information about yourself into one of these forms without submitting, then send them an e-mail asking them to delete your personal information. Bonus points for having your lawyer write that mail, so it gets handled by their legal department instead of regular support. Watch them scramble trying to figure out how to even go about that. When gentle reminders to not irresponsibly collect data aren't enough, maybe a kick in the teeth will do. Shit sites becoming responsible for all the data they soak up couldn't have happened soon enough.

deleted 4y ago
[deleted]
rchaud 4y ago
Or just block the Facebook and Tiktok pixels at the browser level and save yourself the hassle.
XCSme 4y ago
Does a company break privacy laws if you bring a paper with your personal details and put it in their office without telling anyone?
- moreira 4y ago
  No, but if they have a policy of collecting and saving any papers that people have on them, then they’re responsible for that collection. Which is what’s happening here - they’re collecting data that the user isn’t even submitting.
  - XCSme 4y ago
    If they know it's personal data and handle it accordingly it might be ok. What if the user submits personal data without being expected to? For example, I have to enter a nickname on online game before starting to play, what if my nickname is my full name and home address? Now they unknowingly store PII without a privacy policy. What should the company do in this case?
    - wintermutestwin 4y ago
      Delete it if you ask them to.
mort96 4y ago
People keep talking about having "your lawyer" do something as if everyone just walks around with a personal pet lawyer and I never understood it. Are you suggesting that you should hire a law firm at $1000/hour to mildly annoy some website..?
- tsol 4y ago
  Usually "your lawyer" just refers to any lawyer you have a working relationship with, in my experience. I'm guessing this advice is for someone who finds the privacy issue especially heinous
  - stinos 4y ago
    Usually "your lawyer" just refers to any lawyer you have a working relationship with So, none. I've never even met one I think. And I don't think that's quite rare?
    - tokai 4y ago
      If you need one to write a snarky letter you'll end up meeting one. After that you'll have a lawyer. What are you hoping to add with your line of argument?
      - stinos 4y ago
        I understand the definition, that's not the problem, I'm merely expressing some bafflement over the 'your lawyer' term seemingly being used here as something common. And apparently I'm not alone, looking at the other comments.
        slingnow 4y ago
        Would you have been equally confused by someone saying "talk to your dentist"? I don't understand this widespread bafflement. Would it be less confusing to say "talk to _a_ lawyer"? This just seems like a bunch of people arguing for the sake of arguing. It has nothing to do with the original point.
WA 4y ago
In the end, they could deny that they have your data and you will never find out.
aritmo 4y ago
Why not pay a lawyer to create a template and then let others use for free?
- chmod775 4y ago
  It's not about what's in the letter, it's about who sent it. When you personally request something it will get handled by their usual support people, but letters from lawyers usually go straight to legal and get handled there. Legal saying "what we're doing may be problematic" is much more likely to cause change.
tzs 4y ago
> Watch them scramble trying to figure out how to even go about that. It won't be much of a scramble. First, they will look at your email to see if you have actually provided enough information in the email to tell whose data you are talking about and to prove that you are that person. If not you will probably get a response telling you what you need to provide. When you've provided that information, then they will run their standard "delete someone's data" procedure. Whether or not that actually deletes and data that came in via some pre-submit channel will depend on whether they actual realize they have that data. If they are actually using that as an intentional persistent data collection method, it will probably be in some place that is covered by they normal "delete someone's data" procedure. If they are using it for some transitory purpose, it is quite possible that any long term storage was accidental and might not be in someplace the "delete someone's data" procedure covers. In either of these cases it won't cause any scrambling. Finally, your delete request will probably be added to a database along with enough information to identify whose data was deleted. They need this because GDPR data deletion requests do not require the company to immediately go through all backups deleting your data from them. It is likely to remain on old backup media until the ordinary backup media rotation reuses that media for a new backup. Hence, they need to keep a record of deletions and who they were for so that if they ever have to restore from backup then can then reapply deletions. This last is kind of amusing. Where I work we keep very little data on customers beyond what is legally required by the EU. When someone requests data deletion it can actually increase the net amount of data we retain about them. The record of their deletion request can add more data than the deletion request deleted.
matheusmoreira 4y ago
> Shit sites becoming responsible for all the data they soak up couldn't have happened soon enough. Yeah, it's amazing! I think we need even harsher laws. Data should be toxic for businesses. They should be aiming to know as little as possible and to forget everything the second business is concluded. They should be too afraid to do what they're getting away with today.
debug-desperado 4y ago
You think you're going to get discovery to even prove this? Plausible deniability and even just ignorance will likely cause you to get nowhere with wiping this collected data.
lvncelot 4y ago
Bonus points for using the "Nightmare Letter": https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

deleted 4y ago

[deleted]

rchaud 4y ago

Or just block the Facebook and Tiktok pixels at the browser level and save yourself the hassle.

XCSme 4y ago

Does a company break privacy laws if you bring a paper with your personal details and put it in their office without telling anyone?

moreira 4y ago
No, but if they have a policy of collecting and saving any papers that people have on them, then they’re responsible for that collection. Which is what’s happening here - they’re collecting data that the user isn’t even submitting.
- XCSme 4y ago
  If they know it's personal data and handle it accordingly it might be ok. What if the user submits personal data without being expected to? For example, I have to enter a nickname on online game before starting to play, what if my nickname is my full name and home address? Now they unknowingly store PII without a privacy policy. What should the company do in this case?
  - wintermutestwin 4y ago
    Delete it if you ask them to.

mort96 4y ago

People keep talking about having "your lawyer" do something as if everyone just walks around with a personal pet lawyer and I never understood it. Are you suggesting that you should hire a law firm at $1000/hour to mildly annoy some website..?

tsol 4y ago
Usually "your lawyer" just refers to any lawyer you have a working relationship with, in my experience. I'm guessing this advice is for someone who finds the privacy issue especially heinous
- stinos 4y ago
  Usually "your lawyer" just refers to any lawyer you have a working relationship with So, none. I've never even met one I think. And I don't think that's quite rare?
  - tokai 4y ago
    If you need one to write a snarky letter you'll end up meeting one. After that you'll have a lawyer. What are you hoping to add with your line of argument?
    - stinos 4y ago
      I understand the definition, that's not the problem, I'm merely expressing some bafflement over the 'your lawyer' term seemingly being used here as something common. And apparently I'm not alone, looking at the other comments.
      - slingnow 4y ago
        Would you have been equally confused by someone saying "talk to your dentist"? I don't understand this widespread bafflement. Would it be less confusing to say "talk to _a_ lawyer"? This just seems like a bunch of people arguing for the sake of arguing. It has nothing to do with the original point.

WA 4y ago

In the end, they could deny that they have your data and you will never find out.

aritmo 4y ago

Why not pay a lawyer to create a template and then let others use for free?

chmod775 4y ago
It's not about what's in the letter, it's about who sent it. When you personally request something it will get handled by their usual support people, but letters from lawyers usually go straight to legal and get handled there. Legal saying "what we're doing may be problematic" is much more likely to cause change.

tzs 4y ago

> Watch them scramble trying to figure out how to even go about that. It won't be much of a scramble. First, they will look at your email to see if you have actually provided enough information in the email to tell whose data you are talking about and to prove that you are that person. If not you will probably get a response telling you what you need to provide. When you've provided that information, then they will run their standard "delete someone's data" procedure. Whether or not that actually deletes and data that came in via some pre-submit channel will depend on whether they actual realize they have that data. If they are actually using that as an intentional persistent data collection method, it will probably be in some place that is covered by they normal "delete someone's data" procedure. If they are using it for some transitory purpose, it is quite possible that any long term storage was accidental and might not be in someplace the "delete someone's data" procedure covers. In either of these cases it won't cause any scrambling. Finally, your delete request will probably be added to a database along with enough information to identify whose data was deleted. They need this because GDPR data deletion requests do not require the company to immediately go through all backups deleting your data from them. It is likely to remain on old backup media until the ordinary backup media rotation reuses that media for a new backup. Hence, they need to keep a record of deletions and who they were for so that if they ever have to restore from backup then can then reapply deletions. This last is kind of amusing. Where I work we keep very little data on customers beyond what is legally required by the EU. When someone requests data deletion it can actually increase the net amount of data we retain about them. The record of their deletion request can add more data than the deletion request deleted.

matheusmoreira 4y ago

> Shit sites becoming responsible for all the data they soak up couldn't have happened soon enough. Yeah, it's amazing! I think we need even harsher laws. Data should be toxic for businesses. They should be aiming to know as little as possible and to forget everything the second business is concluded. They should be too afraid to do what they're getting away with today.

debug-desperado 4y ago

You think you're going to get discovery to even prove this? Plausible deniability and even just ignorance will likely cause you to get nowhere with wiping this collected data.

lvncelot 4y ago

Bonus points for using the "Nightmare Letter": https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce...