On the 12th of December I made a GDPR request to a major online retailer in the UK.

While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested data nor a notice that it will take longer than 30 days to process the request. I only received an email on January 11 saying that the request is now being processed.

From my understanding, the company has 30 days to comply with the request or, with good reason, inform me that it will take longer (reference).

Did the company violate the GDPR, and if yes, is there anything I can do about it?

  • 1
    what kind of request were you making? To delete your information, or something else? Jan 14 '19 at 23:48
  • 1
    to send me the personal data they have about me Jan 15 '19 at 10:21

The same page at the ICO website also lists what an organisation should do if they refuse to comply with a request:

What should we do if we refuse to comply with a request?

You must inform the individual without undue delay and within one month of receipt of the request.

You should inform the individual about:

  • the reasons you are not taking action;
  • their right to make a complaint to the ICO or another supervisory authority; and
  • their ability to seek to enforce this right through a judicial remedy.

You should also provide this information if you request a reasonable fee or need additional information to identify the individual.

Even if they did not inform you about this, the last two bullet points basically list your options. You can make a complaint (Art. 77 GDPR), or go to court (Art. 79 GDPR) requesting the online retailer to comply with your request. (Or do both). You can request a compensation for damages, but it is often difficult to prove if you have suffered (non-material) damages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.