How long can a company take to answer my GDPR request to download my data? In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be processed. It has now been over 90 days since I received that delay notice and I still haven't gotten access to my data. According to this question a company can inform me that my request will take longer if they are unable to comply with my request within 30 days. I am now wondering if there is an upper limit to how long a company has to process my request or if they can simply delay my request indefinitely?
The data controller is correct: they can take up to three months (approx. 90 days) to process a request, though this is only allowed in exceptional cases. From Art 12(3) GDPR (emphasis mine): The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. You have not received a response in that timeframe, so the data controller has failed to meet its obligations. The polite thing to do would be to remind them that the time has run out, and that you would like a response ASAP. You can lodge a complaint with your supervisory authority. A letter from the data protection authority tends to speed things up a lot :) In principle, you could sue them to get a response. In practice, this is likely to be too expensive to be worth it.
I live in the EU and Facebook has blocked access to my account unless I accept their privacy rules, which means giving up GDPR protections. Facebook operates in the EU and has EU data subjects, therefore Facebook is subject to GDPR. You should be able to withdraw your consent. Article 7(3) says: The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
The intention of the GDPR is to minimize the amount of personally identifiable information (PII) you store. So the GDPR never tells you that you have to log certain events. The simplest way to make sure you comply with the GDPR is to simply not store any PII at all. But that might of course conflict with legitimate business interests and with other legal obligations you might have. So when you do store PII, then the GDPR regulates under which conditions you are allowed to store PII, for how long and what you are allowed to do with that PII. So when you receive a GDPR request from a customer to see their data, then you can say that you only have that one timestamp of their registration, because you didn't log their subsequent logins (assuming this is the truth). I hope your privacy policy says that you store all that PII on registration and that you have some good arguments why storing that information is a &quot;legitimate interest&quot; of your organization.
Yes, you still need consent (opt-in). Cookies usually require consent, but not always. There are two relevant laws at play here: GDPR makes general rules about the processing of personal data, and ePrivacy has specific rules about cookies and similar technologies, regardless of whether the cookies involve personal data. The ePrivacy directive was implemented in your EU member state (or the UK) in national law. The national laws contain the authoritative rules on this matter. But in general: Accessing or storing any information (such as cookies) on the end user's device requires consent. Consent is defined by the GDPR. You do not need consent if the access/storage is strictly necessary for a service explicitly requested by the user (“functional cookies”). Using cookies to store site preferences such as user language is strictly necessary for a service explicitly requested by the user, so you do not need consent for this. You must still make your use of cookies transparent to the user. Setting cookies for marketing purposes is not strictly necessary to provide the service, so you always require consent for them. Registered users don't automatically give consent. You now raise the interesting question if this is also the case if the user is already registered. Yes, you still need consent (opt-in). This is due to the way how the GDPR defines “consent”. Consent is not general or vague agreement. Agreement with your terms of service or privacy policy is not consent in the sense of the GDPR. Instead, consent is defined in Art 4(11) GDPR to be (emphasis mine): any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her Art 7 GDPR adds further conditions for consent. (1) You are responsible for demonstrating that the user has given valid consent. (2) The request for consent should be clearly distinguishable from other matters (i.e. not buried in a larger document) and should be presented “in an intelligible and easily accessible form, using clear and plain language.” (3) Withdrawing consent must be as easy as giving it. (4) In general, you cannot make access to a service conditional on unrelated consent. I.e. you can't force your users to consent to marketing cookies in order to use the app. The users must have an actual choice, or the consent isn't freely given. Supervisory authorities have produced extensive guidance on the matter of consent. If you're in the UK, consider the ICO Guide to Consent and Guidance on the use of cookies and similar technologies. If you're in the EU/EEA, consider the EDPB Guidelines 05/2020 on Consent (PDF). To summarize why agreement with your terms of service is not consent to marketing cookies: Agreement to such large documents is not sufficiently specific. The consent would not be sufficiently informed. You cannot expect users to actually read all your legal documentation. You must present information in an intelligible manner, possibly with multiple layers (compare WP29 Guidelines on Transparency, endorsed by EDPB). Agreement to your terms of service is not an unambiguous indication that the user wants these cookies. If consent to marketing cookies is a condition of using your service, the consent is likely invalid. The consequence is that cookie consent is usually obtained via separate consent management tools that provide detailed explanations about different categories of cookies, and let the user select which specifically categories of cookies they want to consent to, if any. Outside of cookies, consent is just one legal basis among many. In this context, you might ask “if getting consent is so difficult, but GDPR requires that I have consent, how does that work?” It is a common misconception that the GDPR requires consent for everything – the ePrivacy requirement that most cookies need consent is one of the exceptions. In general, GDPR offers a choice of six categories of legal bases for processing in Art 6 GDPR, and consent is just one of them. In many cases, an online service will process personal data because it is necessary to fulfil a contract with the user, or because there is a legitimate interest for the processing (and the legitimate interest outweighs the user's interests). For example, reasonable security measures such as keeping logfiles can be based on a legitimate interest and do not require consent.
Personal data is any information relating to an identifiable person, whether that information is public or not. The student website is definitely processing personal data of faculty. Any website is also necessarily processing personal data of visitors due to technical reasons, even though hosting has been outsourced to a third party. There's always a server, you just might not be managing it yourself. Thus, GDPR applies. Just because it processes personal data doesn't mean that the student website would be illegal. It just means the students are responsible for GDPR compliance of that website. Since the website is controlled by students and not by the university, the university DPO has no say here and the university can't demand the website to be hosted in a particular manner. Nevertheless, the DPO's suggestions might be quite sensible. Typical GDPR compliance steps include: having a clear purpose for which the personal data is being processed having a legal basis for that processing (here, probably a “legitimate interest” which will require a balancing test), see Art 6 providing transparent information to the data subjects providing a privacy notice to website visitors, see Art 13 notifying faculty per the requirements in Art 14 GDPR preparing to fulfill data subject rights such as access, rectification, and erasure when using a legitimate interest, there's also a right to “object” (opt-out) implementing appropriate technical and organizational measures to ensure security and compliance of your processing activities, see Art 24+32 making sure that third parties to which you outsource processing activities are contractually bound as “data processors” to only use the data as instructed by you, see Art 28 if you transfer data to non-European countries, having appropriate safeguards in place Does this sound complicated? It can be complicated. The point is that the internet is no longer the lawless Wild West. Just because you can easily publish a site with personal data, doesn't mean that you should. The GDPR is about requiring data controllers to find an appropriate balance with the rights and interests of the affected persons. Of course there are countries with less regulation, but there are also countries with fewer taxes and that isn't necessarily good for society. The easiest way to avoid these responsibilities will be to stop publishing the site as students – and instead taking up the university DPO's offer to have the university run the site. Which is less fun, of course, but the adult thing to do. If this motivates you further: note that the data controller (the people responsible for the site) must publish their contact information in the privacy notice, typically name + email + street address. The GDPR contains no exceptions that would help here. There is an exception for purely personal or household activities. But if the website would be available to the general public, it would be difficult to argue that this is purely personal. There's also case law such as the Lindqvist case requiring a narrow interpretation of that exception. In Art 9, the GDPR does mention that some restrictions are lifted if the data subject made the information public themselves. But that isn't relevant here, because Art 9 is only about extra-protected sensitive data, e.g. health information, union membership, or sexual orientation.
Don't collect or process personal data Many (though of course not all) websites can easily be run without collecting or otherwise processing any personal data. The position of GDPR is that if you are not able to fulfil the basic, simplest core conditions for processing personal data (understanding what you're processing and why and why it's allowed, describing it in a privacy policy, having a non-underage person who's responsible for that) then you are not allowed to process personal data of other people. So don't. Build your website so that any personal data are not collected.
The retailer You can try making a subject access request under Articles 15(1) and 15(3) of the UK GDPR. Provide as much information as you can (your name, date of purchase, store you purchased it from, copy of the receipt, etc.) and ask for the serial number. If they still have it, and it is stored in a way which is linked to you in an identifiable way, then they are obliged to provide it without undue delay (and in any event within 30 days). You may want to provide a copy of your passport in the request to pre-empt them coming back with an ID check request under Article 12(6), which then allows them to delay processing the request until you have replied. As stated above, if they no longer have the data or you are not identifiable from the data then they do not have to provide it. If they do have to provide it but refuse then you can complain to the Information Commissioner's Office or ask the County Court for a compliance order under section 167 of the Data Protection Act 2018. The insurer Regulation 3(1) of the Consumer Protection from Unfair Trading Regulations 2008 prohibits &quot;unfair commercial practices&quot;. Regulation 3(4) provides that a commerical practice is unfair if, inter alia, it is listed in Schedule 1. Paragraph 27 of Schedule 1 contains the following item: Requiring a consumer who wishes to claim on an insurance policy to produce documents which could not reasonably be considered relevant as to whether the claim was valid, or failing systematically to respond to pertinent correspondence, in order to dissuade a consumer from exercising his contractual rights. As you've provided proof that you purchased the item, you can try to argue that having the serial number of the lost item can not &quot;reasonably be considered relevant&quot;. Yes, the contract says that you must provide it, but consumer rights legislation overrides contractual provisions. You may also want to consider dealing with the insurer by email/post instead of by phone, (a) to avoid continuing to waste time on hold, and (b) because if they systematically fail to respond then this may also cause them to be in breach of the above provision, (c) to acquire evidence which you can use later. Escalating If you get no results from the insurer, make a formal complaint to them through their complaints process. Under the FCA Handbook rule DISP 1.3.1R, the insurer is required to provide a complaints procedure. Under rule DISP 1.6.2R they are required to provide a final response to a complaint within 8 weeks. If you are not happy with the response, you can escalate the complaint to the Financial Ombudsman Service which has the power to make financial awards pursuant to section 229 of the Financial Services and Markets Act 2000 (&quot;FSMA&quot;). Doing so is free of charge and is therefore a good alternative to going to court. The ombudsman can also make awards that are not strictly based on law (i.e. they can go further than the courts can) because of section 228 of FSMA which provides that: &quot;A complaint is to be determined by reference to what is, in the opinion of the ombudsman, fair and reasonable in all the circumstances of the case.&quot; You must generally escalate a complaint to the Ombudsman within 6 months of receiving your final response from the insurer (rule DISP 2.8.2R).
The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data. You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not necessarily a right to demand deletion, but if consent is withdrawn and you have no other basis for data processing, you have to delete. Note also that the consent basis would mean you have to actively contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult. But consider that the news media can process some data about some people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.