Hacker News Reader

Comment by najqh | Hacker News Reader

If you can screw somebody over just for asking to comply with a legal request, the problem is the law.

It’s more complicated than that. The email I received was wrong about my legal obligations to respond. First, I received the email regarding a tiny personal site I operate for the fun of it, and I don’t meet the CCPA deadlines. Second, nothing in the CCPA said I have to reply to random information-gathering requests anyway. And yet, the email gave me a deadline to respond and cited a specific law, claiming that I owed them a response.

I don't know whether the problem is the law or not. Interesting to see some people have seen GDPR as a security risk, but its a great way for people to see what is being used to help an entity carry out its function.

I sent this to my politician and am still waiting for a response but I'm more than interested in what they use tech wise, and I think it covers everything!?!

GDPR Request: Everything you have on me, please highlight what you or your 3rd party's consider to be for law enforcement purposes or for scientific purposes and therefore can not deleted, and please detail all & any 3rd party's who may be required to handle my data that enable you to perform your function of MP when dealing with me. Examples will include Anti Spam and Anti Virus software vendor(s), system's backup companies, cloud infrastructure provider's, network infrastructure provider's, computer equipment provider's, external national or regional department's, private assistant's or secretaries, mobile phone company's, data analytics' company's that have (in)directly identified me in order for you to get into office. This list of examples is not exhaustive. After I have received & reviewed the data, I will inform you of what can be deleted.

It seems to me that your politician needs to be a data controller to do that. It's unlikely that he is one.

I'd argue the opposite - they are likely to be one, especially if they've run a successful campaign.

Candidates and parties will canvass the electorate to identify who is (likely) to vote for who so they can put resources in to the right things and make sure likely supporters turn out to vote etc.

That's not to mention that any (prior) correspondence with the politician (or their office) will almost certainly also contain personal data.

OK, that would make sense. That's more likely a party thing where I live (so you wouldn't contact a random MP but someone in an administrative position in the party), but I imagine it's not necessarily the same thing elsewhere.

In order to communicate via email with British politicians, you have to include your name and address.

I also sent a GDPR request, to GCHQ, MI5, various police constabulary's where I have lived or passed through and the Police national database because a Police constabulary dont have to pass information to the central national database.

Its quite interesting knowing what they know about you and would urge all Europeans to do the same ie GDPR your security services & police forces!

I dont have a mortgage, but in theory you could also use GDPR to do this if you have the deeds to your mortgaged property, you could DSAR your mortgage lender and then ask them to remove all your data from their system as its not scientific or law enforcement purposes and you should also time it so that all the credit data agencies like equifax and experian also remove all trace of your mortgage at the same date and time. In theory you should end up with a mortgage free property but I cant try this as I dont have a mortgage.

Hacking isnt just restricted to Computers, you can exploit the law as well. :-)

Not the legal system which requires the steep cost of representation?

They did not screw anyone over, their email specifically says that it is not a data request. I remember one person saying they had a panic attack reading the email. Like come on, let's be real.

I got the email and I nearly had a panic attack. The email wasn’t completely generic: it referred to my specific site. It also read an awful lot as if it was coming from someone who would be looking for the slightest mistake in my response so that they could sue me. Similar things happen[1]. And finally, it lied and said I was compelled to respond, quoting a law that said no such thing (and which wouldn’t apply to my zero-revenue personal project website anyway).

The stress wasn’t from the email. It’s that it gave every indication that I was being contacted by a legal troll, and that I might have to defend my hobby project in a courtroom. I couldn’t afford the costs of doing that, even if I ultimately won, and the idea of “well, there goes the college fund because of a stupid lawsuit on my hobby” was awful.

[1] https://tucson.com/business/group-barred-from-filing-disabil...

Thank you for sharing your experience; you're shedding more light on the situation than anyone else is right now. Out of curiosity, would you be willing to copy and paste the email contents here?

Edit: Ah, I found your blog post[1].

[1] https://honeypot.net/post/dealing-with-princetons-flawed-pri...

Reply on news.ycombinator.com