I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response:
A Workspace Primary Owner, as the data controller, is responsible for determining whether profile information requires deletion. If you wish, you may also want to reach out to your Workspace Primary Owners as we can only delete profile information upon their request.
If you have any questions about this process, please refer to this page in our Help Center: https://get.slack.help/hc/articles/360000360443-Delete-your-profile-info-from-Slack
Somehow this doesn't feel right. Slack claims that the organisation (or person in many cases) running the Slack is the data controller, but the "data controller" doesn't even have normal access to more than 10000 messages if they're not paying Slack. Does this make sense legally?
And what if this "data controller" doesn't comply to my request? Or is dead or doesn't even exist anymore? Isn't it Slack's responsibility to remove my data in this case?
This reddit thread is related. Which got me to 1a of [Article 17 of the GDPR], that states
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
To me this clearly applies to most (probably all) of the Slacks that I was on, since most of my data (i.e. messages) are not even visible anymore. Is this correct?