1

I have received a suspected scam telephone call. Searching the internet for the number I found that "phone block 247520 is operated by DIDWW Ireland Limited". Searching this I came across the Ofcom response to a very similar incident that makes no mention of the possibility of using the GDPR to require the Communications Provider to identify the source.

It seems to me that the Communications Provider would be a data processor, as they are routing the call to my number, with is personal information. Would a subject access request set to the GDPR contact email on their web site be valid, in that they would be legally required to sent it to the relevant data controller?

Improve this question
3
  • ... assuming you get that information, what is it you plan to do with it?
    – Clockwork-Muse
    May 27 at 16:34
  • @Clockwork-Muse It is going to depend what it is. I would hope to be able to keep going until someone who is supposed to will not respond (in which case I tell the ICO) or I find out where they got my number.
    – User65535
    May 27 at 16:42
  • Performing your own investigation is likely not worth your time, and you're likely to be missing tools or powers you'd need to get much of anywhere. That's assuming all the companies involved are even in the EU, which isn't a guarantee (while to an extent it's true the GDPR applies globally, that doesn't help if the phone provider is only intending to operate in a foreign country).
    – Clockwork-Muse
    May 29 at 17:58

1 Answer 1

Reset to default
2

I don't see this getting you anywhere, an SAR to the telecoms provider will put them in the position of having to give you the PII they have of yours, but I doubt they would be giving you anyone else's. So you might get the what you already know: that you received a call at the date and time. DDIW are just a SIP/VoIP provider, they aren't the ones that called you and they aren't going to be giving you the customer's identity who did.

Improve this answer
4
  • Would not the Communications Provider would be a data processor, and therefore have to pass your SAR to the data controller?
    – User65535
    May 28 at 9:05
  • @User65535 - maybe, but that likely doesn't materially change the result; the controller would likely still not provide the other party's information.
    – Clockwork-Muse
    May 29 at 17:50
  • I email an SAR to DIDWW, the data processor. Either they forward that to the data controller, and the DC provides the requested data or I email the ICO complaining about DIDWW. If enough people email the ICO they may hassle DIDWW. This only works if DIDWW is a data processor, so I asked the question.
    – User65535
    May 29 at 18:04
  • I am pretty sure that in the given context DDIW are going to respond as a data controller (because they are), and that's where it end
    – motosubatsu
    May 29 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .