I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expectation of customers and prospective customers (Europeans at least).
For instance, if you wish to know if they are GDPR compliant you could ask them something along the lines of "Hello there dear valued business relationship, I would like to know if you are aware of the changes in legislation re. privacy and if so whether or not you are at present compliant with that law and if not if you have a time-table when you will be'.
To ask for the maximum under threat of reporting a party to the regulator is not aligned with 'probing for GDPR compliance'.
Asking for the maximum shows you exactly how compliant an entity is.
As it stands it's clearly an attempt at causing the wheels to grind to a halt, the title of the request and the context in which it has been presented are evidence of that as is the faux concern laced through the letter. This is not a request made in good faith.
It that case, I want to know about all the data that company has regarding me, and how they got it. Most likely I also want them to delete it too.
Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place). And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy.
I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem.
In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
Agreed, but that's not the letter writers goal.
> It that case, I want to know about all the data that company has regarding me, and how they got it.
Agreed.
> Most likely I also want them to delete it too.
No, you absolutely want them to delete it, and besides that to tell you if they passed it on.
> Given that their first communication with me is totally unsolicited email marketing, it seems reasonable that if I can reach for a legalese template for a GDPR request, and that raises the chances they’ll take me seriously, then it would be a good thing, almost the precise opposite of trolling (which is more or less what the company was doing by attempting to get data about me in the first place).
Yes, but the letter writer is by their own admission not in that situation, they're a customer of the company, so a direct relationship between them and the company exists, which most likely was initiated by the letter writer.
> And I truly don’t have sympathy for companies like this if they find that answering GDPR requests takes up a lot of their time and they lose money as a result. That is literally the only way they will care about data privacy.
Agreed, but again, that is not the context.
> I agree that this template could be used for trolling, but there are so many valid, positive outcomes that could be made easier by such a template that I think it’s unimportant to focus on possible trolling until it becomes a material problem.
No, it will be used for trolling, in fact it already is being used for trolling. And that's a net negative, which if enough idiots do it will cause the GDPR to be devalued to the point where it is no longer very useful.
> In fact, this just gives companies a way to disingenuously whine about GDPR to legislators. “Look how many troll requests are clogging our system!” When really, many templated requests aren’t troll requests.
That's the whole problem isn't it? Check the context in which the original letter (see link in article) is presented. It's a clear example of trolling.
On reading the template, it seems super obvious that it doesn’t assume a goal of only being applied to situations when you’re already a highly engaged customer.
Things might be on a spectrum. I might have signed up for a newsletter years ago, then later come to regard that company as a big data risk, then accidentally forget about my old newsletter account.
It would be fine to call myself “an existing customer” in that case, even though my connection to the company is not like a vigorous customer relationship with a company whose services I use all the time.
That’s just a common idiom, very clearly not intended to mean the template is intended for spamming around to every big box company you’ve ever engaged with or something.
You can write, “I’m your customer,” while still feeling that you don’t trust that company and what your request for a comprehensive overview of how they use your data to be taken seriously (hence the template’s value).
In that case it looks like the burden lies with you, not with the company and to send a letter like this in that context would be total overkill. I'd start off with a simple request to remove my data.
Another way to put it is: I’m generally deeply mistrusting of corporate entities collecting my data at all — even very upstanding corporate entities — and believe basic prudence requires me to treat them all with skepticism about my data.
If you ask someone whether they are complying with the law, you're likely to just get an inconsiderate "yes", with no indication they even understand the law (there is certainly plenty of misunderstanding that I have seen already, from companies large and small). Making specific questions about their business practises, such that they will have to plainly lie in order maintain a false claim of compliance is more rigorous.
But different strokes for different folks, of course everybody is free to do what they want. But then you should be aware that a torrent of these requests are not going to help make matters better, they will just cause people to tune out and regulators to stop taking the complaints serious.
It's like bringing a chainsaw to a surgery.
There have been enough data breaches that distrust is always warranted when a company has my data.
If they can't give a convincing answer, then bigger guns are appropriate.