The GDPR loop of physical mail requests ( Is there a way to stop it ? ) It is confusing how this kind of a malacious person an be stopped: A person does this: A GDPR request is sent asking for right to access . The request itself bundles some personal information with it. Under accountability clause the given recipt of previous request must be kept . Second request sent because the recipt will contain personal information which is to be accessed by mail physical mail.Basically he wants to access recipt of previous one. Step 2 is revisited. A bussinesses wealth will be drained like this as they cannot claim request is manifestly unfound or excessive as new records are kept after every request. HOW TO STOP IT !
Artice §12(5) GDPR limits the right to access: Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. A request to request the filing that you acted on their request is already excessive, repeated and frequent requests could be acted upon by taking the not-acting steps or sending an invoice before any action is taken. Also, very frequent requests with overlapping times might be answered jointly. It would be good to inform the customer in the last answer granted for free, how often they requested information and that any further answer might incur such and such fees for compiling the information.
Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies. This is a case for Art 11 GDPR: processing which does not require identification. The pastebin site is not required to collect identifying info just in order to facilitate later deletion. If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though. But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again. In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste. None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader. Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context. You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.
This is a good question, as it raises an issue which places the controller's interest in providing a smoothly functioning customer sign up process against customers' right not to have their data leaked. Note that it is not necessary to consider &quot;enumeration&quot; here. Even just being able to check whether one person has a registered account raises the issue. The relevant provisions of the EU GDPR (or in the UK, the UK GDPR as defined in sections 3(1) and 205(4) of the Data Protection Act 2018) are (emphasis added): Article 4(2): 'processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction So, disclosure of the fact that a user has a registered account amounts to &quot;processing&quot;. Article 6(1): Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Of these, only (a) and (f) are likely to be of any relevance: (a) is not too useful since it isn't feasible to design a sign-up system that depends on the user's consent (which they may not give). That leaves us with (f). As noted by the Information Commissioner's Office, &quot;Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.&quot;. The legitimate interest here would be that you need a sign up system which prevents duplicate registrations. Remember though that the processing has to be &quot;necessary&quot; for the purposes of the legitimate interest. One might argue that it is not since you could design the system to give the appearance of accepting the duplicate registration followed by sending an email to the account holder to inform them. On the other hand this will result in a less user friendly experience which could itself be a legitimate interest. Ultimately this is a balancing exercise and it is hard to say whether you have struck the right balance until someone complains to the ICO or the court and a decision is issued. The fact that the practice is widespread among well-resourced and large companies would tend to indicate that it is lawful albeit this is not conclusive in the absence of a court decision. I'm not aware of any cases involving this particular issue but would be interested to hear from others on this point. If the processing is unlawful then Article 18 is applicable: The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: [...] (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. In other words, the data subject could ask you not to disclose their registration status via the sign up page, and you would be obliged to comply with the request. Separately from the above points, in order to be lawful you must provide the data subject with certain prescribed information at the time when the data is collected. Of particular relevance here are the following items: Article 13(1): Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: [...] (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; So even if you conclude that the processing will be lawful you will have to give some consideration to the basis so that you can comply with the above provision.
These are only tangentially related to the GDPR A government entity processing data in accordance with a member state law is ipso facto in compliance with the GDPR. That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be constitutional or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.
There are no specific criteria for deciding whether a request is manifestly unfounded or excessive, because this depends very much on context. The ICO has given some clarifications, but they still won't tell you an allowed frequency of requests. We (as data subjects) should not invent particular criteria because they would be only our opinion. In any case, the data controller would have burden of proof to show that a request was indeed manifestly unfounded or excessive. That means that a data controller will generally err on the side of caution and allow repeated requests. But that doesn't mean you won't get pushback on your proposed frequency. I think your proposed approach is likely to be both unfounded and excessive. A controller has one month to respond to your request. Sending off a request while a previous request is still pending would likely demonstrate an excessive frequency of requests. Even if the data controller responds more quickly, it is doubtful whether that would entitle you to more frequent updates. Since the data controller will inform you about important events with a letter, this weakens your need to make frequent requests. Your “Bayesian model” is also flawed, both in content and application. As your prior, you expect a very high rate of events. However, a normal citizen would expect to receive a parking fine approximately never. Your model should more correctly be based around the probability of missing an event, while also accounting for letters (which generally do arrive in time). It might also be incorrect to use your circumstances as the basis for determining a reasonable frequency. The ICO suggests multiple factors (nature of the data, purposes of processing, how often the data is altered, relationship with other GDPR rights). These factor's generally relate to the controller's processing, but not to your individual circumstances. Next, your requests seem unfounded: the purpose of your requests is not aligned with the GDPR, and automated requests raise doubt about whether the request is valid. Your motivation to make the requests is “to know about claims such as parking fines […] when something goes wrong with the letters sent”. This is a fairly speculative reason since letters generally do arrive well. In contrast, the GDPR provides for the right to access “in order to be aware of, and verify, the lawfulness of the processing” (Recital 63). You are not claiming the right to access for the purpose of verification and to obtain information about the processing, instead you're abusing the GDPR rights to create a kind of API that auto-updates. So, is three months a hard and fast rule? Definitely not, but it seems like an unobjectionable, reasonable frequency. If a data controller thinks a request every three months is excessive, you'll likely be able to push back successfully. But with more frequent requests, you're entering a grey area. Here, it becomes increasingly likely that the controller is able to demonstrate that your requests are invalid.
The obligation to notify the supervisory authority (CNIL in your case) no longer exists. It was part of the previous regulatory framework, but it is not part of GDPR (which takes affect tomorrow). If you use CCTV that may monitor employees (i.e. they sometimes enter the HQ to consult with the owner), your obligations under the GDPR is basically to inform the employees that the CCTV cameras are there. I.e. Data subjects are entitled to understand when their personal data is being processed, covering the transparency aspect of processing. The use of CCTV must be communicated via signage which indicates the areas covered and instructions for further information.
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.
You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business Thus, the option to have the disclosure sent by mail only applies to consumers who do not have an account with the business. Since presumably a large number of sites only maintain personal information for users with accounts, such sites need not provide a mail option. Further, it doesn't say there needs to be a button: you just need the ability to say you'd like it mailed to you in the request somehow, and then they need to comply when you do.