Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don&#39;t comply? So, I've been receiving a lot of spammails recently and I'm pretty fed up with them. I've also been wondering, how they got access to my mail-address, so I sent a request of information so I can see, what data they store about me, where they got it from and whom they sent it to. Could I sue the company behind the scam, if they don't comply the GDPR? (Please excuse the bad English, I'm not a native speaker)
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
[I'm not so well-versed on US and Russian law, thus I will limit my answer to EU law.] Your specific use of a user identifier, as I understood from your question, can be classified as personal data, so in your case, the GDPR seems to apply. This means that you need to have a) legitimate purposes to process that personal data (e.g. crash reporting) and b) a legal justification for each purpose of processing: it could be based on consent or another legitimate purpose (inc. your own legitimate interests). Consent might not be the best option for you, but it's up to you to decide. In any case, you need to assess the risks to the data subjects (your users) before you decide. How likely is it that you will get breached, and what potential harm will that cause to your users? These are some guidelines; my recommendation is that you read the law and the guidelines by the Article 29 Working Group and European Data Protection Board, or hire some good experts on this. There is no easy answer, or one size fits all solution. The GDPR isn't so hard to understand or implement, but it does require some change in mindset. With the new law, processing personal data carries a higher risk of penalties, so you should do it only when it's absolutely necessary, and with respect to the rights of your users.
No. As long as you don't see and have no means to access this data, but it is under the control of the user at all times, you are neither the controller or the processor of this personal data, and the GDPR does not apply to you.
An Art 15 Subject Access Request (SAR) “shall not adversely affect the rights and freedoms of others.” It would be a grave violation of privacy for an email provider to search its users' account contents. It is therefore likely that the email provider would refuse to fulfil that subject request, unless required to perform a search via a court order. Instead, the SAR could be directed to the account holder (Alice or Dave), if they are subject to the GDPR. Depending on the exact legal framework, emails might be protected under confidentiality of communications rules, making such searches similarly illegal to wiretapping. At least in germany, I am fairly certain that an email provider would be criminally liable if they were to disclose emails from their users' email accounts to a third party.
It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. If the website terms which you agreed to don't include this data matching, then that processing is not lawful. The rest of Recital 50 is relevant and worth quoting in full: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. It seems to me that an anonymous account could reasonably expect that the &quot;further processing&quot; of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website. Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.
The data controller is correct: they can take up to three months (approx. 90 days) to process a request, though this is only allowed in exceptional cases. From Art 12(3) GDPR (emphasis mine): The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. You have not received a response in that timeframe, so the data controller has failed to meet its obligations. The polite thing to do would be to remind them that the time has run out, and that you would like a response ASAP. You can lodge a complaint with your supervisory authority. A letter from the data protection authority tends to speed things up a lot :) In principle, you could sue them to get a response. In practice, this is likely to be too expensive to be worth it.
Please note that Google Analytics do not anonymize the data you collect on its behalf unless you configure it to do IP-anonymization. If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) in place with Google in order to comply with the GDPR. This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics. Does data that is anonymized need to be collect in the event of a GDPR Subject Access Request? No. But as the controller, you need to make sure that is is anonymized.
You won't be able to get around self-doxxing yourself. § 5 Abs 1 TMG requires tele-media service providers like you to list den Namen und die Anschrift, unter der sie niedergelassen sind the name and the address where they reside or are established Similarly, Art 13(1) GDPR requires you to provide the identity and the contact details of the controller In a German context, it is generally accepted that both of these involve a ladungsfähige Anschrift, i.e. a street address where you could be served with a lawsuit (not a post box). These requirements exist for both natural persons and legal entities, and for both businesses and non-commercial activities. The TMG Impressumspflicht talks about “geschäftsmäßige, in der Regel gegen Entgelt angebotene Telemedien” but in practice this only requires that the service could be paid (not that you're actually making any money), and that the service is offered routinely/business-like (not necessarily commercially). It does not matter where your service is hosted as long as you live in Germany. The TMG and GDPR might not apply if the forum is run purely privately, e.g. if it is only made available to a few close friends or family members.