2

Concerning the individual's right about information about one's data, Art. 12 GDPR ("Transparent information, communication and modalities for the exercise of the rights of the data subject"), (3) says

... Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

Now if someone askes a company for his data via email (free) and wants to get the answer via postal mail, the company has some cost (letter, print-out, stamp), which is minor, but becomes huge if

  • a large number of people perform such requests
  • someone with bad intentions sends lost of requests via different emails (easy to generate anonymously) and requests postal mail answers to different addresses which are taken e.g. from some phone book. Here it is nearly impossible to prove that the requests are "unfounded or excessive" as described in (5) of Art. 12 GDPR because they look like coming from a lot of different people. Some online tools could easily be abused to create such requests (for sure this is not the intention of such a tool, but the whole question came to my mind when I was playing around with this tool in the link).

Question: In case a company is flooded by such "asymmetric" requests, how should a company react? Start answering via email and ignoring the requester's wish to get postal mail?

Improve this question
3
  • 1
    I am not even sure an asymmetric request is even allowed under GDPR, and in most cases, requests from the phonebook won't even match with the data the company owns.
    – Trish
    Commented Feb 1, 2021 at 12:47
  • @Trish: Well, the tool in the link generates a letter to be sent, with a very general request for data and as minimum a name as identifier. And it sounds like an answer is required, even if it is "we don't have any data from you". Therefore, it would not matter if the phone book data would match with any company data, just providing valid addresses for all the "we don't have any data from you" - letters.
    – UweD
    Commented Feb 1, 2021 at 14:04
  • Just wanted say this question is something I was wondering about and you asked it.Well Done!
    – protectgoodlivingbeingask
    Commented Feb 1, 2021 at 14:05

1 Answer 1

Reset to default
3

In case a company is flooded by such "asymmetric" requests, how should a company react?

Although article 12.5 refers to singular "a data subject", it can be inferred that exposing the controller to significant expenses is not part of the legislative intent. Accordingly, the company may have requesters choose between paying a reasonable fee for the ensuing administrative costs or withdrawing the requirement that delivery be by postal mail.

The bad faith scenario you outline seems to be a non-sequitur, since generally a pattern (or a high number) of requests for postal mail delivery should prompt the controller to suspect that some or many might not be legitimate. A requester with bad intentions would be unable to prove the identity of the various data subjects he impersonates or alleges to represent.

Improve this answer
4
  • Obviously, it is not intended by GDPR to make such problems. And it will be obvious to the controller that something is wrong with such requests, even if this is ramping up slowly, but still the question remains what to do in such a case. I am especially referring to the kind of letter produced by the tool in the link provided by the Bits of Freedom foundation, where just the name of the requester can given, and the demand for a response.
    – UweD
    Commented Feb 1, 2021 at 14:16
  • 2
    @UweD "still the question remains what to do in such a case". See 2nd sentence of 1st paragraph: have requesters choose between paying for or withdrawing the postal mail requirement. Both approaches are better than outright "refus[ing] to act on such request" (see art. 12.5.b). "I am especially referring to the kind of letter produced by the tool". If the tool output gives no information (such as data subject's email address) for the controller to ascertain the legitimacy of requests, that is rather safe grounds for the controller to dismiss the suspicious ones.
    – Iñaki Viggers
    Commented Feb 1, 2021 at 15:48
  • If many people are making requests, I don't see how any individual request could be considered “manifestly unfounded or excessive”, which would be a precondition for charging for them. Of course that would be easy if multiple requests can be tied to one data subject.
    – amon
    Commented Feb 2, 2021 at 20:46
  • @amon My point is not about singling out an individual request, but about the overall inference that GDPR seeks not to [over-]burden the controller with excessive costs. Generally speaking there is no reason why requesters would massively want delivery by post mail, and the OP's description nowhere suggests that the type of data he has in mind warrants a different conclusion. One cannot expect the GDPR (or any legislation) to prescribe every imaginable scenario, but very often it is possible to identify the approach that is most consistent with the legislative intent.
    – Iñaki Viggers
    Commented Feb 2, 2021 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .