How to make data brokers delete my information without providing more information? Can I take legal action?

Question

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from their databases. At the very least, I would like personally identifiable information to be kept off their websites. Ideally, I'd like them to delete my entire dossier. And moreover, I want them to do so without having additional information like my email address or drivers license details. I am more than willing to call them and create disposable emails, though I prefer to interface as little as possible with them (including spending time on their websites, which often sound suspicious and sensationalist).

I also don't know how feasible or worthwhile litigation would be in this case, but I have dual US-American and European citizenship (specifically for a country with heavy data privacy laws). I have heard that European citizens can get their information removed from American companies, but as far as I know, that only applies to European servers. (However, I don't know this for a fact and would like for this to be confirmed or denied.)

I have looked at the following posts, which are all related to my question but in tangential ways.

1. Removing information as a European from a specific website
2. Removing information from third-party sites and legality
3. Removing/anonymizing information from a specific third-party site

;tldr I'm European-American and have information on data brokers' US-American websites. Can I get them to delete me without providing extra PII and pursue a lawsuit if they don't?

What are my options? Please include sources.

Thank you in advance!

Answer 1

You want to exercise your right to erasure under the GDPR. The link is to the UK Information Comissioner's Office, which is a good source of authoritative information about the GDPR. Note that in these quotes "you" is the organisation holding the data.

The GDPR does not specify how to make a valid request. Therefore, an individual can make a request for erasure verbally or in writing. It can also be made to any part of your organisation and does not have to be to a specific person or contact point.

So any demands that you snail-mail a copy of your drivers license are out of order. Under the GDPR it doesn't matter how you make the request as long as it is clear. Send an email. They should at least email you back with details of the information they need to identify you exactly, although your email address should be just fine in most cases.

If you have disclosed the personal data to others, you must contact each recipient and inform them of the erasure, unless this proves impossible or involves disproportionate effort. If asked to, you must also inform the individuals about these recipients.

So as well as requiring that your data is deleted you should also require that this request be passed on to anyone they have shared your data with, and they should delete your data and pass the request on in turn. Also ask them for a list of everyone they have shared the data with so that you can verify that this has been done.

Your biggest problem will be that many of the organisations on the web page you link with are American, and some are going to think that the GDPR does not apply to them. They are wrong:

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

So as long as you are in the EU then the GDPR covers your data, even if it is being processed outside the EU.

Of course your practical remedies against foreign corporations are rather limited: trying to haul them in front of an EU court is going to involve vast time and expense, but if they won't comply you should make a complaint to the ICO or the equivalent in whatever EU country you are or were in. One complaint on its own won't do much, but I dare say that dossiers are being prepared and someone in the EU has these information leeches in their sights.