The GDPR gives you one month to reply to such requests by default, except if the nature of the request is so complex that you can believably justify why you'd need more time to reply to it. In general, I would recommend implementing automated procedures for answering such requests.

How many of these requests do you expect?

I imagine most companies might only deal with this once or perhaps twice ever, and if they do not keep very much personal data then automating it would not be very efficient use of their time. That's why in general I'd wait until you get such a request, ask your lawyer to explain it (will probably only cost a few hundred pounds), then decide what to do next.

Only very large companies (or companies that deal with a lot of personal data) will benefit from up-front automation.

Since the content of the request is very generic and applies to almost any individual and business, it's not unthinkable that it will be automated on the other end, so anyone can push a button and send the request to hundreds of companies of their choosing.

I certainly have several businesses in mind that I plan to send requests to once GDPR is in place.

EDIT: Although I suppose small, non-EU businesses that mostly do not deal with personal data are unlikely to receive any requests. So you are probably right that "most companies" are unlikely receive GDPR requests.

It’s already been automated.

https://selbstauskunft.net/ exists to allow you to send a BDSG §34 request (like GDPR request, but under the older German law for it) to basically any company. You select the company, sign it, and they automate all other steps.

I’ve sent dozens just this week.

Do you actually read the dozens of responses? Or are you just doing it to annoy people?

Yes, I read the responses and take action upon them. The last time I quit my bank account to move to a different bank.

Also, I'd recommend sending another request some time after quiting your contract with the company, just to make sure they give you a written guarantee that they deleted all data about you they don't _seriously have to_ maintain.

I intend to use it as well. Since I'm about to move, I wait until I have the new address. Yes, I'm interested what I will get in return.

I also consider it activism to keep companies aware of their responsibilities.

..and drive up the cost of goods and services.

Does anyone actually understand that this law will make things cost more?

Keeping my data private has costs associated with it? What a shocker!

Do you also argument against mandatory seatbelts? All they do is drive the cost of cars up. The justice system that works to enforce the laws brings the taxes up should we get rid of it too?

This guy being the equivalent of a car manufacturer in your analogy...

Maybe. But it's worth it.

I read them, and often I make decisions based on this — or can use it to convince e.g. my family to stop using payback (a discount scheme where a company logs all your purchases, even cash ones, and you get ~1% cashback).

Why do you think otherwise?

I think if you can easily automate it this is the time to because it will make everything easier as privacy rights continue their spread to additional countries and on to the UN's charter on human rights. Granting the rest of your users the same rights before they officially have them seems the right thing to do because it does not seem ethical to only uphold some of your users privacy.

Won’t adding round trips to the process (by sending letters indicating you’re delaying) just waste more of your lawyers’ billable hours?

Anyway, the main target of this legislation are the hundreds of businesses you’ve never heard of brokering your personal information. I doubt they have salesforce leads for each person they track, and I think most people want to see that entire industry collapse.

Similarly (in terms of regulatory burden, not consumer sentiment), most legit consumer businesses rely on razor thin transaction costs. Spending any additional per-customer human time could be the difference between profit and loss.

To see the problem, consider what would happen if you walked into any store with affinity cards, and handed this letter to the manager.

> Won’t adding round trips to the process (by sending letters indicating you’re delaying) just waste more of your lawyers’ billable hours?

There are only four requests in this letter, and they were written by a PWC consultant to appear as intimidating and confusing as possible, so a small business that does not have easy access to legal advice would not find it difficult to convince a regulator as such.

That said, a lawyer can help you identify them and ignore the rest. For the cost-conscious, spending time on the ICO's website will also help you discover them so that when you talk to a lawyer you can be efficient with their time (and therefore your spending).

> most legit consumer businesses...

Most consumer businesses do not keep very much personal data, if the cost of understanding this letter within three months would cause a company to go into administration then they were going to fail anyway.

> the main target of this legislation are the hundreds of businesses you’ve never heard of brokering your personal information. I doubt they have salesforce leads for each person they track

I don't agree with this at all. Who do you think the "main target" of this legislation is?

> just waste more of your lawyers’ billable hours?

Why are you using lawyers to respond to DPA / GDPR requests?

If anything that can be automated and it will waste their lawyers time. Sounds fun.

Honestly... none of the questions in this letter are that hard to answer.

I really don’t see what the fuss is about if you run a semi-professional operation.

Then you haven't thought it through or don't understand the gdpr.

Though this letter doesn't mention it, you not only have to provide all data in your systems -- every single db inside your company -- but also data from every 3rd party system. Your transactional emailer, your marketing emailer, your billing system, your logging system, your retargeting system, etc.

Good. Stop casually aerosolizing information about your customers all over the cloud, and ignoring employees casually copying live databases here there and everywhere.

That’s not totally true. GDPR only applies if the data is stored in an “filing system”. Things like logs almost certainly don’t fall under that. (Unless you where feeding them into a data mining system, that would change things)

Believe whatever you want but (1) our lawyers disagree; (2) if you can query your logs, you have to (PS: you can; that's literally the point of things like sumologic); (3) the various privacy orgs that have published reasonable amounts of guidance -- notably ICO and DPC -- disagree.

If you ever log an email address then logs contain PII, and are therefore in scope.

So why not log just username or transaction id?

Because usernames are PII under de GDPR too.

True, but hidden IDs like the row GUID of the user are not, are they? They should be considered more like pseudonymous data[1] as they're meaningless outside the dataset.

[1] https://www.whitecase.com/publications/article/chapter-5-key...

Are you sure about logs? Kafka is in scope afaik.

I think so, too. Certainly, they should be in scope for the “data protection” part, or (extreme example) you would be allowed to log personal data to a publicly visible server.

To be clear, when I say GDPR doesn’t apply. I’m taking about information requests (the topic of the linked article).

The data protection part of GDPR of course applies to all PII regardless of how it’s stored. But that part is not new in GDPR, the EU has had strong data protection laws for a while. (Even if people didn’t talk about it)

Sorry, but ICO stands for "Information Commissioner Office", and they seem to be UK organization, having .uk domain and all that. How can they recommend anything with regard to EU-wide law? Or, stating differently, how their recommendation hold any value at all?

Each country will have a Data Protection Authority (DPA) which is the regulator in the country. The ICO is the one in the UK.

The last letter of the GDPR is Regulation. A regulation is very different than than a Directive (the pre-GDPR law is based on a directive). There is very little wiggle-room with a Regulation, even between countries. The ICO also works with other DPAs currently as part of Working Party 29, which ensures the DPAs are working in Sync.

So the ICO advice is worthy of close study, especially if your local DPA (assuming you have one) has not commented or given guidance on a certain matter.

To add, the difference between directive and regulation is in Article 288 of the TFEU:

To exercise the Union's competences, the institutions shall adopt regulations, directives, decisions, recommendations and opinions.

A regulation shall have general application. It shall be binding in its entirety and directly applicable in all Member States.

A directive shall be binding, as to the result to be achieved, upon each Member State to which it is addressed, but shall leave to the national authorities the choice of form and methods.

Basically, a regulation is like a law. It’s directly binding as law.

A directive is something member states have to implement themselves, probably also by passing a law using their own national process for doing so. As such there can be (greater) differences in the different national implementations of the directives.

The ICO is the government regulator responsible for data protection in the UK, and as such the people who are going to be enforcing the GDPR here.

"The EU" doesn't enforce the GDPR, the Supervisory Authorities in each member state (like the ICO) enforce the GDPR.

The member states have agreed to abide by the GDPR, but their own specific data protection laws are allowed have slight variations, e.g. the specific age limit defining minor vs. adult.

The ICO is seen as a leading voice, with some very good guidance, e.g.: https://ico.org.uk/for-organisations/guide-to-the-general-da...

They're widely respected, but you're right it remains to be seen whether UK and EU enforcement will diverge.

There are a lot of businesses that market and sell in the EU, or that recruit or hire contractors in the EU. GDPR affects not only your CRM, but your marketing and sales stack, your HR stack, and any other part of your business that might touch personal data.

With a good system of record, you can track and manage all of the rest of the information and issues raised in the letter.

That said, in a large company with a lot of legacy systems, it may be tough to extract the actual data itself (or even know if your system of record is complete).