Can I sue a company for testing Captcha when unsubscribing from email? With all the data protection stuff these days I was wondering if it is possible to sue a company for making a user pass a CAPTCHA test when unsubscribing from email. I don't know the law surrounding this issue but the user experience is horrendous: I get an email that I don't want from a company I don't really care about into my personal inbox. They provide a link below, as legally mandated I believe, for me to be able to unsubscribe from their mailing list. I am directed to an external URL where most companies quickly confirm the saved preferences. Why should I need to pass a CAPTCHA when an email was clicked directly from my inbox? This is mostly hypothetical right now, but I am wondering if there are any laws (e.g., GDPR) that would make this actionable.
According to 10 rules for getting email unsubscribes right on Econsultancy, the GDPR says of unsubscribing (my emphasis): There is no specific rule about how companies should allow unsubscribing from email, but the General Data Protection Regulation (GDPR) does state that removing consent should be as easy as giving it. This means that if businesses try to make it difficult or confusing they may find themselves receiving complaints. So, assuming they do not otherwise hinder unsubscribing in some of the ways described on that page, would having to pass a Captcha test stop unsubscribing being as easy as signing up? Obviously, it can depend on exactly how you sign up. Some processes may have involved a Captcha test in the first place, or validating your email to activate an account: in such cases, it feels like a clear draw. Even if all that was involved to sign-up was to enter your email-address on a web-page, then passing a single Captcha test doesn't really sound like a significant difference. Also, much as I hate "defending" companies that try to flood you with emails, there are some practical reasons for including something like a Captcha test. In your question you say "when an email was clicked directly from my inbox". However, they don't necessarily know it came directly from your inbox: Depending on the format of the link, it may be possible for a mischievous third-party to spoof requests to the unsubscribe page. A Captcha helps ensure a human actually did the clicking. Even if the format of the link is "encoded" in a way to make it "spoof-proof", it is known that some email clients might "pre-visit" links they find in emails (see, How to stop e-mail clients from visiting links in e-mail automatically? on StackOverflow). One of the reasons for doing this, I believe, is to help protect users from dangerous links in "phishing" and similar emails. However, it can also mean that without some kind of secondary confirmation (e.g. Captcha), people could get unwittingly auto-unsubscribed by their email client. Overall, I would say that a Captcha alone is not sufficient to hinder the unsubscribing process to the point you can hit them with things like GDPR, especially as there are some practical justifications for including one.
You must get opt-in affirmative consent to process personal data, including tracking people's use of your site or providing targeted advertising. The banner on StackExchange is likely in violation of the GDPR. Do not copy it. It does not have an explicit opt-in, only an opt out which is onerous (leave the site, then manually go in and delete any cookies they set, which may be hard to identify if they are from 3rd parties). The sites you mention that have a gateway are a more correct implementation. Consent must be acquired before processing of data begins, and it must be explicit.
I very much suspect she is in right to 1) no receive promotion emails anymore, 2) Have them close the account again and 3) have them delete her pictures. No, she does not have those rights. She agreed to a legally binding contract when she signed up for the service when she clicked "OK" to open the account. That contract outlines her "rights," as you call them, and they can be very different from what you assume to be ethical and moral bounds to a business relationship. What you imagine to be fair business practices could be generally regarded as fair and normal consumer relations; but that's not necessarily what may be in the contract. What she agreed to in the Terms of Service (TOS) could be some form of long term licensing of her photos to the service, and that could be why they won't delete the photos and why she can't delete them in bulk. The TOS states the terms of the promo emails she agreed to receive. Read the TOS; everything will be outlined. The company is in no way obligated to make life easy for her or change the contract to appeal to her; she agreed to everything, including downloading all her photos. If she didn't read the TOS and feels they copied all her photos "without her knowing", that's her fault. It's possible that the company is breaking consumer protection laws with some of their practices, but you'll need to read Canada consumer laws and see if they require ease of use, permanent op-out of emails, etc. I doubt the company would be flagrantly violating consumer law.
In most jurisdictions a message sent by email is now legally the same as one sent on paper by, say, postal mail, and a name typed at the end, or other indication of source is the legal equivalent of a physical signature. You are probably in the same legal position yu would have been in if you had written, signed, and sent by post a letter of acceptance.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine. It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
The part about "If I'm the owner of the content, surely I have the right to request its deletion" is the problem. Sure, you have the right to request, but you can't legally compel. You have an agreement with them, according to which you got something, and they got something. You can't then take back the thing that you gave them, which is permission to use. You didn't give them the IP itself, which you still hold. Here's an analogy. You may own a car, and can give a person permission to use the car (let's say "if you bring me back a pound of cheese from the store"). You cannot later change your mind (especially after you've gotten the cheese) a say that you retract that permission and therefore they actually stole your car. When permission to use is given, as long as the conditions for granting permission are satisfied, you can't un-give permission.
Legal framework Per Articles 4(1) and 4(2) of the UK GDPR, your email address is most likely personal data (and certainly is once you notify the data controller that it belongs to you), and the storage and use of that data constitutes processing. In order to process your personal data, the data controller must establish at least one of the six lawful bases set out in Articles 6(1)(a) to 6(1)(f). It's quite clear that none of those lawful bases apply in this situation. Hence, the processing is unlawful. Next steps Start by making a request to the data controller under Articles 14(1) and 15(1) for the following: A copy of all personal data (including the email address) which they hold in relation to you. The purpose of them holding the data. The legal basis on which they hold the data. That they erase all personal data which they hold in relation to you, pursuant to Article 17(1)(d) (unlawful processing of data). Per Article 12(3), the data controller is required to respond &quot;without undue delay&quot;, with an upper time limit of 1 month (or 2 months if they notify you of the time extension within 1 month). Sadly, most data controllers in my experience seem to interpret this to mean that 1 month is the standard time limit, even though technically this is incorrect and the standard limit is &quot;without undue delay&quot;. Pursuant to Article 12(6) the data controller can pause the clock by asking you for additional information if they have &quot;reasonable doubts concerning [your] identity&quot;. If you send your request from the email address in question then they can't really have &quot;reasonable&quot; doubts, but be aware of this possibility in any case and respond promptly to any requests to confirm your identity so that the clock resumes. Most likely they will be unable to (correctly) provide an answer to points 2 and 3 above, since they do not have a genuine purpose or legal basis. If, after the maximum deadline has expired, they have still not responded and/or erased the data, you have two options: Complain to the ICO under Article 77(1). The ICO has the power under Article 83(5) to fine the data controller up to the higher of 4% of their turnover or £17,500,000. Complaining to the ICO is free and easy and is usually recommended over option 2. Issue a claim in the County Court for a compliance order pursuant to Article 79(1) and Section 167 of the Data Protection Act 2018. You also have the right to claim compensation for &quot;material and non-material damage&quot; (including distress) pursuant to Article 82(1) and Section 168, but this may be unrealistic in the case of a few unwanted emails. Option 2 is not free: you will need to pay a court fee and, unless you represent yourself, legal fees. There may also be additional cost risks if you lose the case. Mentioning the above two points in your request could be an effective way to persuade them to comply in the first place.