73

Out of curiosity, I've submitted a GDPR request just now.
(I live in the Netherlands, so the GDPR applies to me)

The fact that I've had to confirm my request through my attached email is excellent, but I was a little surprised by the response time described in the request's status page:

Enter image description here

I'd assume there's some kind of system that can automatically collect my data and gather it in a (somewhat) comprehensible format.

Maybe there's even a "Okay" button some employee has to click to approve my request, but even then, the maximum response time of a month seems... Excessive.

I've heard from another user that their request submitted a week ago hasn't gone through yet.

Would it be possible to get some insight on why a GDPR request can take that long, or what kind of (apparently manual) process has to be taken care of?


#Update

So, I got a rather quick update on my request:

[We are unable to process your request]3

This looks like a statement of being short on manpower to handle the request.

It also appears to be the end of that specific GDPR request. Unless I'm wrong, this is a violation of the obligation to provide the requested data.

Update: The request was completed on 28/10/2019. It's not clear if that was because of the email I sent them, but that doesn't really matter.

Please note that I've edited out the actual ID of that request, for obvious reasons.

  • 3
    @ArtOfCode: I've edited out the actual ID of my request. – Cerbrus Oct 25 '19 at 13:07
  • 1
    When I did that a while ago, the request first remained in a pending state for two week. I asked per mail at that point, and then I got a mail a bit later that it is being processed, and 20 minutes later a mail that it is finished. The "unable to process" message is weird, and I don't see any valid reason this should be sent for a valid and confirmed request. – Mad Scientist Oct 25 '19 at 13:30
  • 1
    You look into the code, no one ever thought GDPR would be used and function GDPR{ # todo } – djsmiley2kStaysInside Oct 25 '19 at 13:45
  • 1
    Out of interest, what did you request? You could just request the data that SE hold, and who they share it with, or you could request deletion (amongst other things). – djsmiley2kStaysInside Oct 25 '19 at 13:45
  • 7
    Just to clarify: that status is an end message, not a short on manpower message, and usually means it was rejected because there was something off about the request. I'm not familiar with the exact reasons that can cause a request to be rejected, but you should definitely follow up with that email. – animuson Oct 25 '19 at 13:48
  • 3
    @djsmiley2k-CoW: I's a basic "Export my data" GDPR request. There are no options to it: stackoverflow.com/legal/gdpr/request – Cerbrus Oct 25 '19 at 13:50
  • 3
    Note that requests can be denied if excessive or unfounded (I'm not stating that applies here), but in that case upon request they should state why they determined that to be so. So yeah, definitely follow up on that one. – Bart Oct 25 '19 at 13:52
  • 2
    I believe "excessive" is meant to apply to a single person making requests unreasonably often and "unfounded" would apply to non-EU residents or identity theft situations. – Gort the Robot Oct 25 '19 at 14:32
  • 1
    I believe you have to be resident in the EU to make a request... but IANAL. – ColeValleyGirl Oct 25 '19 at 15:02
  • 1
    @ColeValleyGirl You don't have to be to make a request, but if you are then they have to follow it through (which I would assume Cerbrus is from their profile which states they're in one of the founding (and still present) countries) – user394554 Oct 25 '19 at 15:10
  • 2
    @NickA, yes -- I should have said to have your request met. As you say, Cerbrus almost certainly qualifies (unless he's on an extended trip elsewhere). I'm interested to find out why he's been turned down. – ColeValleyGirl Oct 25 '19 at 15:12
  • 1
    Yea, born and raised in the Netherlands, so the GDPR certainly applies to me. – Cerbrus Oct 25 '19 at 15:14
  • 1
    @LinkBerest: yea, done :-) – Cerbrus Oct 25 '19 at 15:22
  • 2
    @Cerbrus In case you're interested, I made a request (I didn't even think about doing it before I saw this post), and it was completed and the data made available within 45minutes. Perhaps they may want proof of identity, not sure. – user394554 Oct 25 '19 at 15:23
  • 1
    Remember Hanson’s Razor. The GDPR is fairly new, so it is not surprising if organizations are having issues. – Gort the Robot Oct 25 '19 at 16:17
29

It seems that "officially", a company has one month of time:

You have one month to respond to a request.

from ico.org. ( the company can respond by explaining it will need more time though )

And further below:

The GDPR requires that the information you provide to an individual is in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Long story short: a GDPR request might result in serious churn on the side of the company receiving that request. And as the results need to be correct and of high quality, one should simply expect a lengthy waiting period.

| improve this answer | |
  • This is probably the reason for that mentioned timespan. – Cerbrus Oct 29 '19 at 7:45
  • @cerbrus I (accidentally) sent a GDPR request to Huawei some time ago (basically I have an ID there, and my fitness tracker puts its data into their cloud) ... that response came back within a few days, but it was kinda hard to digest. Probably the real answer might be that you tell us in the end how long your request took. – GhostCat Oct 29 '19 at 7:52
29

Interestingly, they've failed at the first step, by not making you aware of the things that GDPR instructs them to do so. As I read it, that is a refusal to process your request (as they've not asked to identify you, which appears to be the only (valid) reason to not process the request 'right away'.

As per https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

What should we do if we refuse to comply with a request? You must inform the individual without undue delay and within one month of receipt of the request.

You should inform the individual about:

the reasons you are not taking action; their right to make a complaint to the ICO or another supervisory authority; and their ability to seek to enforce this right through a judicial remedy. You should also provide this information if you request a reasonable fee or need additional information to identify the individual.

Can I require an individual to make a subject access request? In the DPA 2018 it is a criminal offence, in certain circumstances and in relation to certain information, to require an individual to make a subject access request. We will provide further guidance on this offence in due course.

| improve this answer | |
  • 1
    They still have up to a month to provide that information (depending on your interpretation of without undue delay). However, with the current message, it's a bit unlikely they will. – Erik A Oct 25 '19 at 13:56
  • SE Inc is a US company, they don't have to comply with GDPR at all as GDPR is an EU law. – Burgi Oct 25 '19 at 14:45
  • 5
    @Burgi I wouldn't be so sure that GDPR doesn't apply. – mason Oct 25 '19 at 14:55
  • 15
    @Burgi: They have EU users, so they have to comply. – Cerbrus Oct 25 '19 at 14:55
  • 19
    @Burgi Ummm no, if you're holding data on people from the EU then you have to comply with GDPR for those people – user394554 Oct 25 '19 at 14:55
  • 2
    I would be extremely interested in seeing that case being taken to court. I geniunely don't think that any fine could be enforced. But this is derailing from the question, perhaps it is one for law.se? – Burgi Oct 25 '19 at 15:16
  • 2
    @Burgi Well considering the first enforcement of the GDPR was in Canada, I would assume so (although I think they complied within the 30 day warning they were given in order to avoid the fine) – user394554 Oct 25 '19 at 15:21
  • 3
    If a company allows users to create accounts from the EU, the GDPR absolutely applies to it. The only alternative is to deliberately block access for EU users. – Gort the Robot Oct 25 '19 at 16:15
  • @Burgi If a company has no physical representation in the EU, enforcing some penalty (getting them to pay the fine) can be complicted if they just refuse. But even if they don't pay, the EU isn't out of options, and at very least, ignoring the legal system of EU countries will make any EU-related business considerably harder. Companies that provide services, employees that work remotely, anything... – deviantfan Oct 25 '19 at 18:10
  • @deviantfan, they do have physical presence in the EU (at least until Brexit) -- their EU Privacy officer is located in London. Source: stackoverflow.com/legal/privacy-policy – Nate S. Oct 25 '19 at 19:11
  • 2
    They have a subsidiary in Germany. Source: stackoverflowbusiness.com/de/talent/impressum – Josef says Reinstate Monica Oct 25 '19 at 19:15
  • @NateStrickland I could be wrong, but I don't think that's an employee of their company. Privacy officers can be external persons. (Then again, a different question is how much such an external officer can be used as scapegoat in court - might be even more than I think) – deviantfan Oct 25 '19 at 21:28
  • @Josef ooh, I didn't know that. That's far more clear than their London person. And now I can happily wait for the straightforward legal response on their refusal... – deviantfan Oct 25 '19 at 21:30
8

My own data request ended without trouble, and within a 15 minutes time frame, proving the process has been heavily if not fully automated unlike you previously thought.

You might just have been out of luck, and a temporary outage or service exception made the service unavailable. Next steps should probably include referring to the support.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .