Reply to: Strange GDPR Request

[AtW]

Counter it with GDPR demand for source they used to get your contact info

[AtW]

There's a github for the text. data/access-tracking.txt at master . datenanfragen/data . GitHub

Probably some idiot has done a GDPR infringing mail spam.

FTFY

[bobw]

I've received the exact same message today, I know it's a template but the wording is identical, even some phrases which I haven't found in any of the templates, like "Thanks: for your support!". Seems spammy to me, it's from a gmail address. I was planning to ignore it but I'm not sure.

I've found this thread from googling some of the message content.

[NotAllThere]

There's a github for the text. data/access-tracking.txt at master . datenanfragen/data . GitHub

Probably some idiot has done a mail merge.

[vetran]

That's what I thought: send GDPR request including PII, get told "We have nothing about you", then report them because they have the PII you provided in the original GDPR request but said they didn't have any

You can retain information for the purposes of providing information.

So you can record John Doe made a request.

One assumes you can then say your policy is to delete request verification information if no confidential information is found to avoid storing confidential information. Pop that in your reply.

[Old Greg]

That's what I thought: send GDPR request including PII, get told "We have nothing about you", then report them because they have the PII you provided in the original GDPR request but said they didn't have any

Gödel would say that the company would be compliant in this scenario, because you hadn't sent a meta-GDPR request.

[NickFitz]

I guess you also need to remember in the subsequent response (if there is one) to mention the GDPR request with the appropriate data sent and confirmation that you've deleted it from all systems. I mention that as it's the obvious thing you most people would miss out.

That's what I thought: send GDPR request including PII, get told "We have nothing about you", then report them because they have the PII you provided in the original GDPR request but said they didn't have any

[Old Greg]

6 months to go before this EU sheet will hopefully be repealed

GDPR that, suckers.

[AtW]

6 months to go before this EU sheet will hopefully be repealed

[eek]

Fishing mail looking to try and get a case to claim compensation.

You are obliged to confirm their identity before you provide information, so I would reply asking for date of birth, postal address and supporting documents such as copy of a drivers licence, passport and utility bill.

You could give a quick response that says something like

"Based on the information provided we do not believe we have ever processed information relating to you. If you wish us to conduct a more through search please provide the following information:

Proof of:
Full Name
Date of Birth
Postal Address

This may be in the form of a copy of your drivers licence, passport, household utility bills etc.

We may only disclose personal data, if held, once we have confirmed the identity of the requestor."

I guess you also need to remember in the subsequent response (if there is one) to mention the GDPR request with the appropriate data sent and confirmation that you've deleted it from all systems. I mention that as it's the obvious thing you most people would miss out.

[SimonMac]

Fishing mail looking to try and get a case to claim compensation.

You are obliged to confirm their identity before you provide information, so I would reply asking for date of birth, postal address and supporting documents such as copy of a drivers licence, passport and utility bill.

You could give a quick response that says something like

"Based on the information provided we do not believe we have ever processed information relating to you. If you wish us to conduct a more through search please provide the following information:

Proof of:
Full Name
Date of Birth
Postal Address

This may be in the form of a copy of your drivers licence, passport, household utility bills etc.

We may only disclose personal data, if held, once we have confirmed the identity of the requestor."

Cheers, quoted recital 64 in terms of the ID, hopefully you're right and its a fishing activity.

[DimPrawn]

Gotta love the EU, GDPR red tape, website cookie red tape.

No wonder the EU are going down the pan.

[Old Greg]

Email them back confirming you have no record of them.

Follow up with a GDPR request.

[DimPrawn]

Where is the senders email from if you look through the raw email guff?

Probably sent via some scammy domain in mother Russia

[DimPrawn]

Is it a great way of spammers verifying email addresses?

If it were me, I'd pretend I never received it.