This is a follow up to my two previous questions, "In the data request page, what does the "Object to Processing" request type do?" and In the data request page, what does the "Do not sell my information" request type do?, both still unanswered as July, 30th 2024.
Today, a user on the Tavern chatroom pointed out that the procedure to request a dump of your own personal data is also unclear.
As I stated before, the current silence from the Company regarding these concerns seems to go against the founding principles of clarity and transparency described by the current GDPR laws.
Article 12
"Transparent information, communication and modalities for the exercise of the rights of the data subject"
1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
I don't know if this constitutes an actual sanctionable violation, but it is pretty clear that the intent behind this article is to provide the users with a clear explanation about their right that does not require wild guessing to get anything done.
Let's review them in order.
Data Deletion is indeed self explanatory. It concerns the right an user has to be forgotten and the resulting action is the anonymization of said user content. The form actually provides a little explanation when this option is selected.
Readability: 10/10Opt Out: no explanation whatsoever. It is clear that you can "Opt out" from something, but the page fails to explain what exactly you can opt out from.
Readability: Woah, this is worthless!Update Data: self explanatory. It concerns the right to have the controller update any missing or wrong data about yourself and it is standard coverage by the GDPR law. That said, compared to "Data deletion" no explanation is given in this case.
Readability: 9/10Access looks like it should be clear enough. Apparently this is about the right to know what data the controller holds about you. Like "Data Deletion" selecting this option does also provide a little clarification text. Relates to "Data Portability".
It is worth noticing that the second options seems to imply that an user is entitled to request a full dump of their own "Subscriber Content".
Readability: 9/10 (apparent) / 5/10 (real)Object to Processing and Restrict Processing: The base issue here is the same as the "Opt out" option: the site does not explain exactly what we should be objecting to. Yet the simultaneous existence of TWO separate options for "objecting" (and thus I assume denying the right to) and just "restricting" (which implies that you are just restricting SOME aspects of what the company can do) manage to make this even worse.
Readability: It's less than worthless, my boy!Data Portability: Data Access and Data portability are actually two separate rights under the GDPR law - you can find a basic explanation here. The company tries to address them separately but in doing so actually causes more confusion. For some reason the explanation for the data Access options is written in a way that looks like you will receive a copy of your data, but that is more related to Portability. I suggest that either the two options are better explained or they are merged under a single option (since this should be sufficient for most scenarios) Readability: 5/10
Do not sell my information: where can I start? The company is still taking its time to clarify if their own ToS states that they won't sell your data... or the exact opposite, and now we get an option to request that they don't do something they said they won't?
Readability: Pointy-Haired Boss tongueFile a complaint: I'll agree this does not require further explanation. If you are actually filling a complain you probably already have pretty clear what this is all about and you may even have filled a GDPR violation report already...
I think the situation is pretty clear to everyone. The page is as clear as muddy swamp water.
I don't know if this should be attributed to the company being actually clueless, doing the bare minimum to not get sued or if there is an actual malicious attempt in making things confusing on purpose so that the userbase does not realize their own rights.
Yet I think this can't be left this way. I am therefore officially asking for a rework of the data request page that will finally work out these concern and provide a CLEAR and EASY TO UNDERSTAND explanation of our right and how to act on them.
More importantly, since recently the company - or should I say its controller entity Prosus - has been VERY keen on the idea to use our contributions to make money in the AI/LLM field and restricting our access to the data dumps, I also request that said page shall clearly illustrate how and to whom Prosus is selling our data, what data is actually sold (with special attention to PII) and hopefully an explanation of the double licensing the company seems to grant itself on our contribution based on the current Terms of Service.
