72

Out of curiosity, I've submitted a GDPR request just now.
(I live in the Netherlands, so the GDPR applies to me)

The fact that I've had to confirm my request through my attached email is excellent, but I was a little surprised by the response time described in the request's status page:

Enter image description here

I'd assume there's some kind of system that can automatically collect my data and gather it in a (somewhat) comprehensible format.

Maybe there's even a "Okay" button some employee has to click to approve my request, but even then, the maximum response time of a month seems... Excessive.

I've heard from another user that their request submitted a week ago hasn't gone through yet.

Would it be possible to get some insight on why a GDPR request can take that long, or what kind of (apparently manual) process has to be taken care of?

#Update

So, I got a rather quick update on my request:

[We are unable to process your request]3

This looks like a statement of being short on manpower to handle the request.

It also appears to be the end of that specific GDPR request. Unless I'm wrong, this is a violation of the obligation to provide the requested data.

Update: The request was completed on 28/10/2019. It's not clear if that was because of the email I sent them, but that doesn't really matter.

Please note that I've edited out the actual ID of that request, for obvious reasons.

Improve this question
23
  • I'd encourage you to follow up via that email address and get the request completed.
    – ArtOfCode
    Commented Oct 25, 2019 at 13:07
  • 3
    @ArtOfCode: I've edited out the actual ID of my request.
    – Cerbrus
    Commented Oct 25, 2019 at 13:07
  • Ah. That makes more sense...
    – ArtOfCode
    Commented Oct 25, 2019 at 13:09
  • I've sent out an email requesting clarification.
    – Cerbrus
    Commented Oct 25, 2019 at 13:18
  • 1
    When I did that a while ago, the request first remained in a pending state for two week. I asked per mail at that point, and then I got a mail a bit later that it is being processed, and 20 minutes later a mail that it is finished. The "unable to process" message is weird, and I don't see any valid reason this should be sent for a valid and confirmed request.
    – Mad Scientist
    Commented Oct 25, 2019 at 13:30
  • 1
    You look into the code, no one ever thought GDPR would be used and function GDPR{ # todo }
    – djsmiley2kStaysInside
    Commented Oct 25, 2019 at 13:45
  • 1
    Out of interest, what did you request? You could just request the data that SE hold, and who they share it with, or you could request deletion (amongst other things).
    – djsmiley2kStaysInside
    Commented Oct 25, 2019 at 13:45
  • 8
    Just to clarify: that status is an end message, not a short on manpower message, and usually means it was rejected because there was something off about the request. I'm not familiar with the exact reasons that can cause a request to be rejected, but you should definitely follow up with that email.
    – animuson StaffMod
    Commented Oct 25, 2019 at 13:48
  • @animuson: Thanks for the information. I'm curious to see how that'll be followed up.
    – Cerbrus
    Commented Oct 25, 2019 at 13:49
  • 3
    @djsmiley2k-CoW: I's a basic "Export my data" GDPR request. There are no options to it: stackoverflow.com/legal/gdpr/request
    – Cerbrus
    Commented Oct 25, 2019 at 13:50
  • 3
    Note that requests can be denied if excessive or unfounded (I'm not stating that applies here), but in that case upon request they should state why they determined that to be so. So yeah, definitely follow up on that one.
    – Bart
    Commented Oct 25, 2019 at 13:52
  • 2
    I believe "excessive" is meant to apply to a single person making requests unreasonably often and "unfounded" would apply to non-EU residents or identity theft situations.
    – user399157
    Commented Oct 25, 2019 at 14:32
  • 2
    @Cerbrus In case you're interested, I made a request (I didn't even think about doing it before I saw this post), and it was completed and the data made available within 45minutes. Perhaps they may want proof of identity, not sure.
    – user394554
    Commented Oct 25, 2019 at 15:23
  • "Come May 2018 however, information must be provided to the individual without delay, and at the latest, within one month of receipt of the request." and "The new rules do give some breathing space for organisations in that they can extend the deadline by a further two months where the individual’s requests are complex or numerous. If this is done, the organisation must notify the individual of this within a month of receipt of the request, providing its reasons for the delay." gdpr.report/news/2017/11/15/…
    – Jan Doggen
    Commented Oct 25, 2019 at 15:32
  • 1
    Remember Hanson’s Razor. The GDPR is fairly new, so it is not surprising if organizations are having issues.
    – user399157
    Commented Oct 25, 2019 at 16:17

3 Answers 3

Reset to default
29

It seems that "officially", a company has one month of time:

You have one month to respond to a request.

from ico.org. ( the company can respond by explaining it will need more time though )

And further below:

The GDPR requires that the information you provide to an individual is in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Long story short: a GDPR request might result in serious churn on the side of the company receiving that request. And as the results need to be correct and of high quality, one should simply expect a lengthy waiting period.

Improve this answer
2
  • This is probably the reason for that mentioned timespan.
    – Cerbrus
    Commented Oct 29, 2019 at 7:45
  • @cerbrus I (accidentally) sent a GDPR request to Huawei some time ago (basically I have an ID there, and my fitness tracker puts its data into their cloud) ... that response came back within a few days, but it was kinda hard to digest. Probably the real answer might be that you tell us in the end how long your request took.
    – GhostCat
    Commented Oct 29, 2019 at 7:52
29

Interestingly, they've failed at the first step, by not making you aware of the things that GDPR instructs them to do so. As I read it, that is a refusal to process your request (as they've not asked to identify you, which appears to be the only (valid) reason to not process the request 'right away'.

As per https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

What should we do if we refuse to comply with a request? You must inform the individual without undue delay and within one month of receipt of the request.

You should inform the individual about:

the reasons you are not taking action; their right to make a complaint to the ICO or another supervisory authority; and their ability to seek to enforce this right through a judicial remedy. You should also provide this information if you request a reasonable fee or need additional information to identify the individual.

Can I require an individual to make a subject access request? In the DPA 2018 it is a criminal offence, in certain circumstances and in relation to certain information, to require an individual to make a subject access request. We will provide further guidance on this offence in due course.

Improve this answer
13
  • 1
    They still have up to a month to provide that information (depending on your interpretation of without undue delay). However, with the current message, it's a bit unlikely they will.
    – Erik A
    Commented Oct 25, 2019 at 13:56
  • SE Inc is a US company, they don't have to comply with GDPR at all as GDPR is an EU law.
    – Burgi
    Commented Oct 25, 2019 at 14:45
  • 5
    @Burgi I wouldn't be so sure that GDPR doesn't apply.
    – mason
    Commented Oct 25, 2019 at 14:55
  • 15
    @Burgi: They have EU users, so they have to comply.
    – Cerbrus
    Commented Oct 25, 2019 at 14:55
  • 19
    @Burgi Ummm no, if you're holding data on people from the EU then you have to comply with GDPR for those people
    – user394554
    Commented Oct 25, 2019 at 14:55
  • 2
    I would be extremely interested in seeing that case being taken to court. I geniunely don't think that any fine could be enforced. But this is derailing from the question, perhaps it is one for law.se?
    – Burgi
    Commented Oct 25, 2019 at 15:16
  • 2
    @Burgi Well considering the first enforcement of the GDPR was in Canada, I would assume so (although I think they complied within the 30 day warning they were given in order to avoid the fine)
    – user394554
    Commented Oct 25, 2019 at 15:21
  • 3
    If a company allows users to create accounts from the EU, the GDPR absolutely applies to it. The only alternative is to deliberately block access for EU users.
    – user399157
    Commented Oct 25, 2019 at 16:15
  • @Burgi If a company has no physical representation in the EU, enforcing some penalty (getting them to pay the fine) can be complicted if they just refuse. But even if they don't pay, the EU isn't out of options, and at very least, ignoring the legal system of EU countries will make any EU-related business considerably harder. Companies that provide services, employees that work remotely, anything...
    – deviantfan
    Commented Oct 25, 2019 at 18:10
  • @deviantfan, they do have physical presence in the EU (at least until Brexit) -- their EU Privacy officer is located in London. Source: stackoverflow.com/legal/privacy-policy
    – Nate S.
    Commented Oct 25, 2019 at 19:11
  • 2
    They have a subsidiary in Germany. Source: stackoverflowbusiness.com/de/talent/impressum
    – Josef
    Commented Oct 25, 2019 at 19:15
  • @NateStrickland I could be wrong, but I don't think that's an employee of their company. Privacy officers can be external persons. (Then again, a different question is how much such an external officer can be used as scapegoat in court - might be even more than I think)
    – deviantfan
    Commented Oct 25, 2019 at 21:28
  • @Josef ooh, I didn't know that. That's far more clear than their London person. And now I can happily wait for the straightforward legal response on their refusal...
    – deviantfan
    Commented Oct 25, 2019 at 21:30
8

My own data request ended without trouble, and within a 15 minutes time frame, proving the process has been heavily if not fully automated unlike you previously thought.

You might just have been out of luck, and a temporary outage or service exception made the service unavailable. Next steps should probably include referring to the support.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .