Canceling a GDPR request

Question

If a user informs us that they no longer want to delete their data before we process the order deletion request, are we legally required to cancel it? Or can we modify, meaning delete the data regardless? (Though this is not preferred.) I basically want to ask whether we are forced to answer even if the user cancels the request? example procedure: A person requests deletion of data. An email is sent to them stating their data will be deleted in few days. The person replies that they never sent such a request and the other person was impersonating them. Can we then cancel the request and ask for compensation from impersonator?

Answer 1

If you have reason to believe that the original request was (or might have been) fraudulent, in that it was from someone other than the data subject, you cannot treat it as a valid request. If the data has not yet been deleted, you should stop processing the request until you are able to verify whether the original request was or was not from the actual data subject.

After which you may want to consider whether your initial validation procedure needs to be changed, if the initial request was indeed from an impersonator.

Article 12 (section 6) says:

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

(Note: Deletions come under article 17, and so are within "Articles 15 to 21")

If, however, the case is simply that the data subject has changed his or her mind, and wishes to cancel a valid previous request, then the Controller is certainly entitled to cancel the request. If the controller is not otherwise required to retain the information, then the controller could optionally delete the personal data. (This in the case that there is no issue of impersonation.)

Can we ... ask for compensation from impersonator?

There is no provision, as far as I know, in the GDPR, that authorizes such compensation. It might be that under some other law such a suit would be authorized. That would probably be a matter of national law. But how much actual damage would there be? Proof of actual damage might well be needed for any recovery. And of course, one would need to identify the impersonator, and have good evidence that s/he had in fact committed an act of impersonation.