7 ms·

> Privacy request shouldn't enable mechanisms of denial of service type attacks against companies. How would this even happen? I genuinely don't understand wha

> Privacy request shouldn't enable mechanisms of denial of service type attacks against companies. How would this even happen? I genuinely don't understand what you mean.

michaelmior 4y ago
Users don't like a company, they automatically spam the company with large numbers of requests for personal information which they would legally be required to provide.
- colpabar 4y ago
  Does the same logic apply to FOIA requests?
  - HideousKojima 4y ago
    Most FOIA requests involve a small fee as well for the same reason. https://www.hhs.gov/foia/faqs/what-is-the-cost-for-getting-records-under-the-foia/index.html https://www.hhs.gov/foia/faqs/what-is-the-cost-for-getting-r...
    - Floegipoky 4y ago
      And those fees have been infamously exploited to functionally deny access to material or financially harm the requester. Perfectly illustrating why charging fees for these things is such a bad idea.
- olyjohn 4y ago
  Guess they'd better figure out how to get people their data in a more rapid manner. I guess they could use a computer or something to automate it so that users can just click a button to download their data. I mean, what year is this? We've been hearing "automate it, automate it, etc" for years and years now. But to get your personal data, these companies just throw up their hands and say that it's too hard?
  - colpabar 4y ago
    I couldn't agree more. Even if it does require a person to do something that isn't automated, they should be required to have people on staff whose first priority is responding to these requests. It seems ridiculous to me that people are claiming this is just too hard for a company so they should get to profit off of it. It's our data, dammit!
    - drstewart 4y ago
      >that people are claiming this is just too hard for a company so they should get to profit off of it. Completely disingenuous argument. Literally nobody claimed that. By the same token of strawmanning, you're claiming that businesses should do nothing than hire people to send your data back to you. Why even have businesses if that's the only thing you think they should do? If you're so invested in "your data, damnit", then don't give it to them in the first place.
  - bpodgursky 4y ago
    When we implemented CCPA lookups, one of the many necessary lookups was through a decade of glacier'd request logs (necessary to hold onto for compliance). Even ignoring implementation cost, there was a significant computational cost that's pretty hard to avoid.
emiliobumachar 4y ago
When GDPR was new, several people sent "nightmare letters", deliberately and publicly designed to cause as much cost and hassle as possible. To my knowledge, no one was punished or even inconvenienced for blatantly abusing the law in this way. https://duckduckgo.com/?q=gdpr+nightmare+letters https://duckduckgo.com/?q=gdpr+nightmare+letters
- Nextgrid 4y ago
  The "nightmare GDPR letter" is trivial to deal with: https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter/ https://jacquesmattheij.com/so-your-start-up-receive-the-nig...
legitster 4y ago
For our company, all privacy requests are handled manually by a team I am on. We manually do name searches in about a dozen platforms to see if there are any matching records. 4/5 times there aren't any - people doing the requests often use services that submit blanket requests.

> Privacy request shouldn't enable mechanisms of denial of service type attacks against companies. How would this even happen? I genuinely don't understand what you mean.

michaelmior 4y ago

Users don't like a company, they automatically spam the company with large numbers of requests for personal information which they would legally be required to provide.

colpabar 4y ago
Does the same logic apply to FOIA requests?
- HideousKojima 4y ago
  Most FOIA requests involve a small fee as well for the same reason. https://www.hhs.gov/foia/faqs/what-is-the-cost-for-getting-records-under-the-foia/index.html https://www.hhs.gov/foia/faqs/what-is-the-cost-for-getting-r...
  - Floegipoky 4y ago
    And those fees have been infamously exploited to functionally deny access to material or financially harm the requester. Perfectly illustrating why charging fees for these things is such a bad idea.
olyjohn 4y ago
Guess they'd better figure out how to get people their data in a more rapid manner. I guess they could use a computer or something to automate it so that users can just click a button to download their data. I mean, what year is this? We've been hearing "automate it, automate it, etc" for years and years now. But to get your personal data, these companies just throw up their hands and say that it's too hard?
- colpabar 4y ago
  I couldn't agree more. Even if it does require a person to do something that isn't automated, they should be required to have people on staff whose first priority is responding to these requests. It seems ridiculous to me that people are claiming this is just too hard for a company so they should get to profit off of it. It's our data, dammit!
  - drstewart 4y ago
    >that people are claiming this is just too hard for a company so they should get to profit off of it. Completely disingenuous argument. Literally nobody claimed that. By the same token of strawmanning, you're claiming that businesses should do nothing than hire people to send your data back to you. Why even have businesses if that's the only thing you think they should do? If you're so invested in "your data, damnit", then don't give it to them in the first place.
- bpodgursky 4y ago
  When we implemented CCPA lookups, one of the many necessary lookups was through a decade of glacier'd request logs (necessary to hold onto for compliance). Even ignoring implementation cost, there was a significant computational cost that's pretty hard to avoid.

emiliobumachar 4y ago

When GDPR was new, several people sent "nightmare letters", deliberately and publicly designed to cause as much cost and hassle as possible. To my knowledge, no one was punished or even inconvenienced for blatantly abusing the law in this way. https://duckduckgo.com/?q=gdpr+nightmare+letters https://duckduckgo.com/?q=gdpr+nightmare+letters

Nextgrid 4y ago
The "nightmare GDPR letter" is trivial to deal with: https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter/ https://jacquesmattheij.com/so-your-start-up-receive-the-nig...

legitster 4y ago

For our company, all privacy requests are handled manually by a team I am on. We manually do name searches in about a dozen platforms to see if there are any matching records. 4/5 times there aren't any - people doing the requests often use services that submit blanket requests.