A few days ago I sent a GDPR request to some company to delete my personal data. They said to install their app and send a ticket from the app. The email was sent from the email address to which the account is registered. Is this even legal?

  • _TheNardDog_@lemmy.worldEnglish
    14·
    1 year ago

    No, it’s not at all legal for the company to do this. Reply and remind them they have one calendar month to comply from the date of your original request, otherwise you will make a complaint to which ever information regulator is correct for the juridiction they’re operating in.

    I’m a lawyer specialising in Data Privacy, reply here if you need more help on this one.

    Also feel free to name the company.

    • ram@bookwormstory.socialEnglish
      01·
      1 year ago

      Genuine question: Aren’t you supposed to say “this is not legal advice?” if you identify yourself as a lawyer but you’re not their legal council? Or am I mistaken?

    • account abandoned@lemmy.worldOP
      24·
      1 year ago

      For now, I do not want to announce the name of this company publicly.

      If they don’t want to solve it amicably, then I will do so.

      • sanpo@sopuli.xyz
        8·
        1 year ago

        They already said they don’t want to.

        They asked you to install the app on purpose, in hopes that you’ll decide it’s too much hassle and decide not to delete the account.

        • el_abuelo@lemmy.ml
          06·
          1 year ago

          How do you know this?

          My first thought was “they probably want to ensure they are who they say they are and so want an authenticated request” - while that’s against GDPR, not everyone is as educated as they should be, and not every mistake is a nefarious activity.

          • sanpo@sopuli.xyz
            5·
            1 year ago

            There’s no reason an app should be more trustworthy than the email.
            It’s pretty standard for scummy companies to make the process as annoying as possible.

          • activ8r@sh.itjust.works
            3·
            1 year ago

            The individual responding isn’t the issue. They haven’t made any decision to respond like this, they are following a script.

            The script is written by people who should know exactly what they are doing, so the result is either malice or negligence. Either way it’s unacceptable where the law is concerned.

      • fmstrat@lemmy.nowsci.comEnglish
        4·
        1 year ago

        This is a bad decision, IMO. They may fix it for you, but then you’ve lost the opportunity to assist everyone who comes after you.

        You posted asking the public for help. Please return the favor and report them, as you are legally supposed to do.

        • Scubus@sh.itjust.works
          6·
          1 year ago

          Think of the poor corporation! If they get punished for their illegal buisness practices, it’ll hurt the economy and people will be less inclined to start a small buisness. Didn’t you study piss down economics?

      • rishado@lemmy.world
        2·
        1 year ago

        I will never understand why people complain online then do this. Why are you being such a pushover. What does amicably even mean to you?

      • Rodeo@lemmy.ca
        1·
        1 year ago

        Must be something that makes you look bad lol

        Otherwise you’d just say it. You owe them nothing and they’ve broken the fuckin law and you’re protecting them? What do they have on you?

        • lastweakness@lemmy.world
          0·
          1 year ago

          Or maybe they just want to disclose as little of their personal information, including services relied on, on an open platform like this. Idk if that’s the case, but playing devil’s advocate here

          • Rodeo@lemmy.ca
            11·
            1 year ago

            Personal information like the name of a company they bought something from?

            Please

            • Roboticide@lemmy.world
              1·
              1 year ago

              Why should they not? They posted an inquiry, looking for advice. That is their reason for posting.

              They do not owe personal information beyond what is required to answer the question. And typically, with regards to anything resembling a legal matter, the less information posted publicly, the better.

  • cosmicrookie@lemmy.world
    1·
    1 year ago

    Simply ask for the official company name, registration number and country as well as the prereree means of communication that they would like your local data authorities to contact them on.

    Also make a 1 star review, stating that you are in talks with your local gdpr authorities about their way of handling privacy.

    This worked for me last time a company asked me to download an app to delete my account

  • Jimmycrackcrack@lemmy.ml
    1·
    1 year ago

    I had this before, though not through a direct communication. Someone had gotten my email credentials somehow and installed a company’s app and made an account. When I went through the support pages on the company’s site to find out how to delete the account the only listed way was through the app itself.

    They were accommodating and helpful when I emailed the company about it though. I just told them that I can’t agree to the privacy policy and thus cannot install the app but still need the account to be deleted. They did it.

  • cheese_greater@lemmy.worldEnglish
    1·
    1 year ago

    Then you, kindly dispose urself of all my personal data.

    —Dictated but not read, fuck you Me(also take me to ur leader)

  • Etterra@lemmy.world
    0·
    1 year ago

    I don’t know, maybe? If they have a process, no matter how laborious and roundabout, they can always claim that they have a process and that you have nothing to complain about, legally speaking. Their wagering that people will not go through all the bullshit, and they’re unfortunately right. That’s literally why they do it. The only correct response is to hound them relentlessly, going to Twitter (or something else idk these days, and I’m not calling it X), the press if necessary, and pestering as many government bodies and officials as you have to in order to make them get their fucking shit together. And then they’ll make your particular situation of priority because now you’re being more of a pain in the ass than actually doing their job is. They won’t change the broken system, because one exception in a thousand isn’t worth it to them to be bothered with.

    Tldr, maybe but it probably won’t help you, so make it as big of a headache for them as possible.

  • vsis@feddit.clEnglish
    0·
    1 year ago

    They were very friendly imo. No need to speak legalese or to be rude.

    Just tell them that you can’t or don’t want to install the app.

    If they don’t help you, then you proceed to remind them that you are not required to install anything for them to comply with GDPR.

    • themeatbridge@lemmy.world
      2·
      1 year ago

      Being friendly doesn’t negate the fact that they are out of compliance with the law. Even sending a second email to insist they delete your data is an undue burden.

      • el_abuelo@lemmy.ml
        0·
        1 year ago

        You’re right, but sometimes a bit of undue courtesy repays in dividends. Not every minor infraction is nefarious and not every minor infraction deserves reporting. A simple courteous reminder of their obligations may save both parties some undue hassle.

        I can imagine this company doing this to ensure only authenticated users can have their data removed. There are other ways…but this was probably what they considered reasonable and painless for all, admittedly they (wrongly) didn’t consider the audience of this community in that decision.

        • Rodeo@lemmy.ca
          1·
          1 year ago

          A simple courteous reminder of their obligations may save both parties some undue hassle.

          Actually, the customer is already getting undue hassle, while the company is just breaking the law. Why can’t we just expect better?

          • vsis@feddit.clEnglish
            01·
            1 year ago

            Nobody broke the law lol.

            I believe they have like a month to comply.

            The just asked for a ticket in the app, to make their lifes easier. If OP doesn’t want to, they still have to comply though.

            Now I remember why I hate working directly with customers.

            • Trainguyrom@reddthat.comEnglish
              1·
              1 year ago

              I believe they have like a month to comply.

              According to my training when I was handling my workplace’s GDPR request email companies have 30 days to respond. Meaning they could simply have a bot respond to all incoming emails on day 29 and say “we’re reviewing your request” and be in compliance for a while longer

  • Blackmist@feddit.ukEnglish
    0·
    1 year ago

    It’s way too easy to spoof email “from” addresses.

    There should be a way to do it through their website though. Requiring an app is just stupid.

    • account abandoned@lemmy.worldOP
      1·
      1 year ago

      Their site is just a landing page, there’s no login option or anything like that. Their business is a smartphone application.

      Edit: Gmail uses SPF, DMARC and DKIM signing so spoofing is not possible if their email services are configured properly.

      • Onioneer@sopuli.xyz
        1·
        1 year ago

        SPF/DKIM/DMARC does not prevent sending the spoofed message, though. It is up to the recipient system to filter out the message should the checks fail. Even then, the message often lands into spam instead of being dropped.

        • account abandoned@lemmy.worldOP
          0·
          1 year ago

          Anyway they should configure their systems to reject unsigned e-mails and providers that don’t have a proper SPF configuration. SPF (Sender Policy Framework) allows you to make sure that the message was sent by an approved server and was not forged by some hackur.

          • fatalError@lemmy.sdf.org
            0·
            1 year ago

            You’d be surprised how many legitimate email are sent with failed SPF. Even Microsoft sometimes doesn’t update their MX records and the SPF fails.

            • Onioneer@sopuli.xyz
              1·
              1 year ago

              That is especially true with large organizations where multiple non-technical teams are ordering/configuring products that send email.

              Unfortunately it is difficult to solve, unless services stop allowing sending without verifying and forcing proper configuration. That would drive sales to competitors who do not enforce this, though.

  • Slurpey@lemmy.world
    01·
    1 year ago

    Use this template in chat gpt…

    Can you write an official letter for removal of my private data for (company name) and (my name). Use a strong tone and legalese langage. Make sure you verify the timeframe they must respond (act with 30 days of this letter) and any other specific to make sure they know what my rights are and that I am serious. List the typical types of data they might have on me. And write in a 1800L lexile scale.

    • 404@lemmy.zip
      1·
      1 year ago

      Catch 22: give ChatGPT your data, then try to delete your ChatGPT account using ChatGPT

      • Slurpey@lemmy.world
        1·
        1 year ago

        You can ask the text without name and write it after… I mean really? Search on hugging face for free LLM (that’s the kind of ai of chat gpt) and try it for free without registration there is that’s suuuch a thing

        • 404@lemmy.zip
          1·
          1 year ago

          Oh I was just joking :)

          How are you going to speak to it without revealing any information though? It now knows you need legal advice.