Validity of automated GDPR subject access requests

Question

If a software product was distributed that automated the creation and sending of GDPR subject access requests, do these request impose the same legal requirements on the data processor as if the requests were created and sent manually?

For example, when I visit www.express.co.uk and reject all optional cookies I get data stored on my browser for domains google.com and gigya.com [see below] as well as express.com. It seems to me obvious that these organisations are processing my PII, and therefore I can make a subject access request to them with the information below, and they are legally required to respond to such a request within 30 days. If I was release a browser extension that automated the process of writing and emailing a subject access request to any domain that sets a cookie other that that in the address bar would these requests carry the same legal weight as if they were made by a human?

I note from ico.org.uk that "The GDPR does not specify how to make a valid request" which would seem to allow automated requests. If motivation is important, the objective of developing and distributing the browser extension would be to raise the cost of using web activity tracking techniques such that they are used in fewer inappropriate circumstances. The objective of the user may be the same, or may be more personal.

Content saved on my browser other than requested domain (ID's changed, structure maintained)

• google.com
  • Cookie (identical content for both accounts. and adservice.google.com):
    • NID:"204=E858vg4uiUKytc3sSrlAWuC123456789KUClG7y-ipTwdQ4I9098765uPflA7k-9Nlqz5XejOF09986543u0Fqs7pyA-olmulYz7ge0v1234567qUBOnL_G_3-uP-uY123456778g2u12-R1234567893qac7M"
  • Sesssion Storage:
    • oauth2_cs::https://www.express.co.uk::23456451934-ch6e69vj9h84567890ibm.apps.googleusercontent.com:"{"cachedValue":{}}"
• gigya.com
  • Cookies:
    • gmid:"Psdtlw123456789nR5SeKfwCLu5-6BBi1234567o"
    • ucid:"IE1234567x_Vq_V123456Q"

Answer 1

GDPR Art 12 specifies modalities for the exercise of data subject rights. It seems that a data subject access request (DSAR) can be partially automated, but such an automated request is not necessarily valid.

• Art 12(5): the controller can ignore or charge for requests that are “manifestly unfounded or excessive, in particular because of their repetitive character”.

  If the intent of the DSAR is to harass the data controller or to cause disproportionate cost, that would likely make the request invalid. Sending requests in an automated manner could also easily lead to a flood of identical requests, which could allow the data controller to refuse the requests.

  There is no clear guideline what an appropriate rate of requests would be, but controllers should assume that at least four DSARs per year per data subject are appropriate.

• Art 12(6): the controller can verify your identity before acting on the request, if they have reasonable doubts about your identity.

  Thus, a data controller that receives a clearly automated request might try to make sure that the request was actually sent on behalf of the data subject.

I think a browser addon that extracts cookie identifiers etc in order to assist with DSARs (or compliance surveys) can be helpful, but that automatic DSARs would be easy to challenge and deny.

I'll also point out that most data controllers will not be able to provide useful data just from cookie IDs. That may be technically noncompliant, but successfully challenging this requires a lot more effort than sending easily-ignorable DSARs. Importantly, you'd either have to lodge a complaint with a supervisory authority that then also decides to investigate the issue, or you would have to sue the data controller directly for compliance (Art 79).