Hacker News Reader

Hacker News

Comment by jaclaz | Hacker News Reader

Full thread

jaclaz

Side note/doubt.

By asking to have your data through a GDPR request you are effectively giving to the receiver of the request:

1) your full name

2) your phone number

3) your e-mail

i.e. basically a confirmation that both the phone number and e-mail are good/active/attended and that they are yours (and that you "exist"), while the data they may already have likely is only the telephone number and the patterns of its usage.

I have no idea how it could be possible to make a valid request without providing this kind of info (i.e. providing only the phone number, which they already have).

Maybe a sort of (public/certified) authorization service?

View on HN

I agree that this might be a gap in the law, in theory. However, I've seen how many businesses work and they often don't have a process for randomly enriching production data from e-mails to the privacy department.

There's also the fact that the law does say that this personal data can only be use for the purpose of providing user data and must then be deleted. But we also know that there's little chance companies like this will do that.

It's a double edged sword, but I'm going to err on the side of danger and send in a data request anyway. My curiosity is much bigger than my fear of providing them my e-mail address.

these are the (not so) digital equivalent to what appeared in phone book anyway.

Then, your phone number and emails are in any of your resumes, business card, subscription forms, contact details for any web service... They're not exactly private information anyway

And I'm sure anyone can call your phone number and listen to the message of the voicemail, in which most ppl say their name out loud anyway. Lastly, isn't your email address firstname.lastname@gmail.com, as for most folks ?

> isn't your email address firstname.lastname@gmail.com, as for most folks

I'm going to guess that for 'most folks' there's probably someone else with the same name and therefore this way of guessing someone's email address is far from reliable.

It's actually so unreliable that one email address I have receives mail for others who for some reason think it's their email. This includes plane tickets, accounts for phone contracts and order confirmations.

> It's actually so unreliable that one email address I have receives mail for others who for some reason think it's their email.

Ask me about the Brazilian teenager with my name who keeps using my email to open facebook accounts that I keep recovering the password for and closing.

Gross

Does the full name have to be your legal name?

I use different names/email on every site, but phone numbers are always these 2~3 numbers. If I'm going to send a deletion request under GDPR alike laws, it would be under different names.

> Does the full name have to be your legal name?

Pretty much. Only your person has rights, not the fake identities you created. They can actually request a copy of an ID or something comparable to confirm your identity. You might have a hard time removing your data, in some cases, when using fake names since then your identity can't be confirmed.

Yes, and unlike a sign up for a random site, you are actually stating the info and signing the form, it is as "official" a document as a non-notarized/non-certified one can be, there could be (improbable anyway in practice) legal consequences if you sign something with fake or non-existing data, it is a false declaration.

And when you (if asked/needed by the procedure) provide a copy of your ID, you are actually giving them other data points, like your birth date, often nationality, and in some cases even the address of residence.

> Only your person has rights, not the fake identities you created.

But if they only know u/lucb1e to own +31612345678, then it's all good and well that you're requesting data as Luc Lastname but that's not going to match their records anyway; that doesn't prove you're the legitimate person to send this data to.

> They can actually request a copy of an ID or something comparable to confirm your identity.

When I called the Dutch DPA about this, specifically about MAC address tracking (I got an email "welcome to ikea!", sent to anothercompany@lucb1e.com, when I connected to ikea's free wifi), and they said that supplying the MAC address is the identifier to use because that's the only thing they can match anyway. This was in 2018-ish so I may misremember details, to be fair.

As far as I know, this is similar to copyright under a pseudonym. If you can't prove it's yours, sucks, but if you can, then your rights are yours to exercise.

Reply on news.ycombinator.com