I agree that this might be a gap in the law, in theory. However, I've seen how many businesses work and they often don't have a process for randomly enriching p

I agree that this might be a gap in the law, in theory. However, I've seen how many businesses work and they often don't have a process for randomly enriching production data from e-mails to the privacy department. There's also the fact that the law does say that this personal data can only be use for the purpose of providing user data and must then be deleted. But we also know that there's little chance companies like this will do that. It's a double edged sword, but I'm going to err on the side of danger and send in a data request anyway. My curiosity is much bigger than my fear of providing them my e-mail address.