Can the users of a messaging group ask under GDPR the owners of the group remove them? Then rejoin to repeat (it leads to more processing of their data) if the messaging service provides a "leave button".
asked Mar 31, 2021 at 15:13
-
Your comments to my reply made me wonder. What do you mean by "owner of the group"? In a situation where a company like google allows some customers greater rights than other customers, that does not make the more-privileged customer a data controller under GDPR. That would still be the company providing the service. When you have a situation where a company like Amazon sells cloud space for other companies' services, those will be the the data controller. Which situation do you mean?– o.m.Commented Apr 1, 2021 at 18:55
-
The Google scenario but why is that not a data controller when they can also control the flow of data . For example if an user is deleted their personal data is no longer viewed on page .So isn't deletion privilege data control?– savedesrvinglifebefewquestionsCommented Apr 2, 2021 at 8:11
-
Data controller and data processor are legal terms under GDPR. Both the list admin and the list user are customers of Google in this scenario and the claim of the customer wanting to be removed is against Google, not against the list admin.– o.m.Commented Apr 2, 2021 at 10:42
Add a comment
|
2 Answers
Article 12(5) of the GDPR allows a refusal or the demand of a fee for requests which are "excessive, in particular because of their repetitive character".
I would suggest that before you demand such a fee, you should consult a lawyer in your jurisdiction about the details. How many requests are repetitive?
Also note that the GDPR usually does not give the right to be removed from a group. It allows the right to have any data deleted if there is no other legal reason to keep it. That's a different action. Pushing the button might not immeditately delete old data.
-
So can you ask to delete this post to prevent continued disclosure of your username ? Commented Mar 31, 2021 at 18:29
-
@fewquestions, I cannot ask them to delete this post alone. And Stackexchange may be allowed to retain certain data anyway even if I were to request the deletion of all my data.– o.m.Commented Mar 31, 2021 at 18:55
-
@fewquestions The right to erasure only applies under specific conditions, and can be denied. In the particular case of Stack Exchange, the site provider has a clear right to keep the post itself intact (e.g. due to the CC-BY-SA content licensing). Furthermore, SE posts are usually only soft-deleted which could be permissible under GDPR under a legitimate interest. However, if you completely delete your account, then the username will be replaced by the pseudonymous user ID.– amonCommented Mar 31, 2021 at 18:57
-
@fewquestions, the main thing is that GDPR gives me the right to request information, correction of wrong data, or a deletion of all data not held under other justifications. It is not a right to demand specific changes unless that data is objectively wrong.– o.m.Commented Mar 31, 2021 at 19:13
-
It is not concern about the liability of the group service ( In the SE case not the liability of SE but of the person who asked as that person enabledd the exchasnge of data ) . Commented Mar 31, 2021 at 20:50
Yes.
However, under Article 12
[...]
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
- charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
- refuse to act on the request.
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
-
1It is not at all clear that a request to be removed from a grouip fits any of the provisions of articles 13-22 or 34. If it does no9t, a user may request it, but the GDPR does not say anything about the controller having to grant it. So the "yes" at the start of this answer seems to be incorrect. Commented Mar 31, 2021 at 22:37