4 ms·
> (B) any time beyond the initial 2 times described in subparagraph (A), may allow the individual to exercise such right for a reasonable fee for each request.
by prego_xo 4y ago
> (B) any time beyond the initial 2 times described in subparagraph (A), may allow the individual to exercise such right for a reasonable fee for each request.
Paying any sum of money to receive a copy of or request to delete my private data is unreasonable in nature.
- drstewart 4y agoThis is normal: https://www.techrepublic.com/article/how-to-request-your-personal-data-under-gdpr/ https://www.techrepublic.com/article/how-to-request-your-per... >Although, the ICO also notes that a firm may charge a “reasonable fee” when “a request is manifestly unfounded or excessive, particularly if it is repetitive.” Privacy request shouldn't enable mechanisms of denial of service type attacks against companies.
- ortusdux 4y agoThe problem is, "reasonable" is subjective. Things like this need to be tethered to something. "The fee may not exceed 50% of the hourly federal minimum wage."
- bin_bash 4y agoThat’s just not true. “Reasonable” is a binding term used in contracts all of the time. The court system is extremely experienced in determining what is and is not reasonable.
- QuarterReptile 4y agoMuch like passing a bill to find out what's in it, going to court to discover the rules is not a healthy way for society to run.
- bin_bash 4y agoGoing to court to discover the rules is precisely how common law systems work
- giantg2 4y ago"The court system is extremely experienced in determining what is and is not reasonable." Almost always to the dismay of one party, and sometimes to the dismay of the general public.
- MerelyMortal 4y agoNot always. According to lemon law lawyer Mr. Lehto (who runs a Youtube channel Lehto's Law), RVs are not covered under most state lemon laws, and thus defers to the federal Magnuson Moss Warranty Act which just says repairs must be under a reasonable time frame, and the RV companies say something like 10 repairs, 6 months each, is the industry standard and thus reasonable, and judges don't have anything else to base that on, so they agree.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- riversflow 4y agoI don’t want to have to go to court to not be extorted over my data.
- jdasdf 4y agoIt's certainly experienced in making stuff up.
- ortusdux 4y agoLeaving the fee uncapped creates an incentive for business to put zero effort into making the reporting process efficient. That way, they can demonstrate that compliance requires 5 skilled hours (for example) and "reasonably" charge $250 per report. Courts rule on the evidence provided. If a user challenges the fee, the company can easily document where every penny went, and therefore claim it is a reasonable charge. The user's only real recourse would be to prove that company is over-billing, but that would require evidence. Pegging the cost to a set number of labor hours by law signals to companies that part of the cost of collecting this data is they must develop their internal systems in a way that they can quickly and easily comply with requests.
- smileysteve 4y agoFrom a foia perspective the courts and government agencies aren't great at "reasonable".
- drstewart 4y agoGDPR is filled with "reasonableness" expectations and unspecified guidelines that aren't tethered to anything. Why the concern over this one specifically?
- dsr_ 4y agoThis one, I dunno. But in general, EU/EC law is full of policy that gets interpreted as human judgement calls, and US law is full of details that are interpreted as badly-written code with a choice of parsers. The two styles are not compatible.
- scarface74 4y agoYes because a 99 section 11 chapter law is really easy for small companies to follow…
- scsh 4y agoEU laws can often be written in such a way and are a bit looser in their language in ways when compared to how it may be written in the US. EU courts are more experienced with dealing with interpretations of "reasonableness" for a given law when compared to the US, so it's not really a fair comparison.
- smileysteve 4y agoYes, what's reasonable to a company may not be reasonable to a consumer. Ie, as a company can create process that uses 10 man hours and my cheapest labor with overhead is $50/hr, but we can find countless CNBC articles that say the average consumer can't afford a $500 expense.
- nightski 4y agoI wonder if a company can be DoS'd via privacy request maybe they are collecting more data than they can effectively handle and that should be re-examined.
- rt4mn 4y agoI agree privacy request shouldn't enable mechanisms of denial of service type attacks against companies. But I don't think that justifies allowing companies to put in place fees to access personal data. If cloudflare required people to pay to bypass their denial of service protections... well, I guess I dont know what would happen, other then that I would hate them even more then I already do for all the terrible things they do for my experience as a default tor browser user.
- prego_xo 4y agoDoS is an understandable concern, but charging for a service is probably one of the least sensible ways to prevent it. To me, it just looks like the most profitable and impeding hurdle that companies can set up to prevent users who want to access their own data. I would be frustrated if any application made me pay even a small fine because they suspect a DoS attack. For example, entering my credit card info because I've searched a phrase too much just isn't efficient.
- colpabar 4y ago> Privacy request shouldn't enable mechanisms of denial of service type attacks against companies. How would this even happen? I genuinely don't understand what you mean.
- michaelmior 4y agoUsers don't like a company, they automatically spam the company with large numbers of requests for personal information which they would legally be required to provide.
- colpabar 4y agoDoes the same logic apply to FOIA requests?
- HideousKojima 4y agoMost FOIA requests involve a small fee as well for the same reason. https://www.hhs.gov/foia/faqs/what-is-the-cost-for-getting-records-under-the-foia/index.html https://www.hhs.gov/foia/faqs/what-is-the-cost-for-getting-r...
- Floegipoky 4y agoAnd those fees have been infamously exploited to functionally deny access to material or financially harm the requester. Perfectly illustrating why charging fees for these things is such a bad idea.
- olyjohn 4y agoGuess they'd better figure out how to get people their data in a more rapid manner. I guess they could use a computer or something to automate it so that users can just click a button to download their data. I mean, what year is this? We've been hearing "automate it, automate it, etc" for years and years now. But to get your personal data, these companies just throw up their hands and say that it's too hard?
- pooper 4y agoStrong disagree. There are already other options for malicious actors, most notably Americans with Disability act.
- olyjohn 4y agoMaybe they should automate the requests then. There's zero reason why they couldn't just write something where you log into your account and click "download my data." These companies are happy to harvest up all your data, run all this crazy automation, spend millions analyzing algorithms, setting up machine learning, NFTs, run datacenters, networks, etc etc, but they can't figure out how to automate GDPR requests? FUCKING BULLSHIT. There is literally zero reason why a data request should add any burden to a tech company.
- thayne 4y agoSo you could have something like each person is allowed two free data requests per year, after that you can charge for it, or something like that.
- legitster 4y agoI mean, at our company, GDPR requests have to cost at least $50 a pop. It goes to a human team to review and process with a dedicated legal representative.
- olyjohn 4y agoNot my problem. You're the one collecting the data. You pay for the costs. Can't afford to collect my data? Go out of business then.
- legitster 4y agoWe have to process the request regardless of whether we actually have your data or not.
- smileysteve 4y agoseems like you should either make the lookup automatable or stop collecting. eu citizens wont have such a fee.
- legitster 4y ago>make the lookup automatable Yes we should. But there are a few too many systems, and we add and drop systems with such regularity that it would still be a non-stop engineering challenge. >stop collecting For the few records we do return as part of GDPR requests, they are usually associated to customer and billing data. I don't know how you run a business without that. > eu citizens wont have such a fee. They do and it's collected in the cost of higher product costs.
- micromacrofoot 4y agoIt's your problem until there's a law saying otherwise.
- gbear605 4y agoSounds like an appropriate cost of doing business with data. If you don’t want to pay for it, collect less data.