Under GDPR, do organisations have to tell the ICO (or similar) the email address they use for GDPR deletion requests?

Question

As is well known, websites (illegally) use deliberately misleading and frustrating web design to slow down users who want to tell them not to collect information for marketing purposes.

If they collect this information, they have to delete it and (presumably?) stop collecting it in the future if a user emails them to tell them so. However, finding this email address means going to all the organisations which might hold data about you and trying to find what email address they use.

In the UK the ICO enforces GDPR. Do data holders have to tell the ICO what email address they use for deletion requests?

Answer 1

No. While UK data controllers must register with the ICO, they only have to provide general contact details. The ICO does not provide a public registry of data controllers. Outside of the UK, there is no requirement to register with the Supervisory Authority unless a DPO is appointed.

Per Art 13 GDPR, every privacy notice must disclose the contact details of the controller, and of their DPO (if applicable). The GDPR does not require controllers to have a specific email address for data subject requests. Controllers have to fulfill the request regardless of the channel through with the request is made, so that normal channels for support or contact should be appropriate. The ICO writes in its guidance to controllers on the right to access requests:

Are there any formal requirements?

No. The UK GDPR does not set out formal requirements for a valid request. Therefore, an individual can make a SAR verbally or in writing, including by social media. They can make it to any part of your organisation and they do not have to direct it to a specific person or contact point.

Of course, if a controller does not make contact details available or otherwise refuses to accept a valid data subject request, you can ask the ICO for assistance.