If users decide to run a viral laege scale flashmob to get their data in terms of GDPR from a company, is this procedure legal?

Like, competing who manages to make a request to inform about their data on most days in a calendar year?


It is perfectly fine to exercise your rights under the GDPR, and to encourage others to do so. However, a Data Controller may not have to comply with such requests:

  • Art 12(3): If a Data Controller gets many requests, their deadline for compliance might extend from the usual month to up to three months total.
  • Art 12(5): Where requests are “ manifestly unfounded or excessive, in particular because of their repetitive character”, the Controller can:
    • refuse to act on the request; or
    • charge a reasonable fee

There is no clear limit that defines when requests become “excessive”. Some data controllers only give you one free copy of your data per year.

Note that many Data Controllers do not care how often you exercise your data subject rights because the processes are often automated. Where self-service options exist (such as a “delete my account” button) you can be required to use that option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.