There is a person named aa 1 where aa is their first name and 1 is their surname. Now some other person makes an email named aa.1@somemailingcompany.com. Whose personal data is this? aa 1's or that other person's? How is a request from the real aa 1 answered then to access the email?
asked Feb 1, 2021 at 3:44
-
It would be great if someone also freely provided some insight on done on ccpa.– savegoodlyfnotendorsanswerhereFeb 1, 2021 at 3:45
-
Comsumer credit protection act? Or which ccpa?– o.m.Feb 1, 2021 at 5:51
-
California consumer privacy act .– savegoodlyfnotendorsanswerhereFeb 1, 2021 at 13:29
-
ccpa would be a completely different question. Don't ask it in a comment.– o.m.Feb 1, 2021 at 16:06
Add a comment
|
1 Answer
I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about some of their data held by some institutions, depending on the legal basis for the data processing.
One John Smith does not have the right to see the data of any other data subject named John Smith, and he cannot even demand to know if there are other John Smiths in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account jsmith@sample.org, one can assume that he is the John Smith who opened the account. If not, then not.
If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?
