This was kind of an interesting comment from that thread. "Just invoke GDPR" is a refrain that's oft-repeated on Reddit (and, dare I say, HN), but it didn't see

This was kind of an interesting comment from that thread. "Just invoke GDPR" is a refrain that's oft-repeated on Reddit (and, dare I say, HN), but it didn't seem to do much in this person's case: > I did an SAR with Google last year and it took over a month for a single account. It also ended up containing very little because of the way they decide what is and isn’t ‘personal data’, e.g. for the one I used for work, they outright refused to release most of it apart from specific emails and docs where I was mentioned by name because the email address was a standard contact@mywebsite.com (which to be fair is correct grounds for refusal). They were very helpful in padding out the SAR release by re-sending the emails of me requesting the SAR, and also redacted the data protection employee name whom I was conversing with though lol. > For SARs themselves there’s also grounds to refuse if they think it might interfere with potential future legal investigations, which given the ban reason I suppose isn’t an impossibility but unlikely.