There is a person named aa 1 where aa is their first name and 1 is their surname. Now some other person makes an email named aa.1@somemailingcompany.com. Whose personal data is this? aa 1's or that other person's? How is a request from the real aa 1 answered then to access the email?

  • It would be great if someone also freely provided some insight on done on ccpa. – scientist Feb 1 at 3:45
  • Comsumer credit protection act? Or which ccpa? – o.m. Feb 1 at 5:51
  • California consumer privacy act . – scientist Feb 1 at 13:29
  • ccpa would be a completely different question. Don't ask it in a comment. – o.m. Feb 1 at 16:06

I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about some of their data held by some institutions, depending on the legal basis for the data processing.

One John Smith does not have the right to see the data of any other data subject named John Smith, and he cannot even demand to know if there are other John Smiths in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account jsmith@sample.org, one can assume that he is the John Smith who opened the account. If not, then not.

If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.