I made 20 GDPR deletion requests. 12 were ignored

by nikola-k • 6 months ago

143 133 6 months ago

GDPR is privacy theater

Insanity• 6 months ago

Somewhat, but not entirely. For smaller players it's a hassle/PITA but it does enforce some checks and balances on the larger players.

zxcvasd• 6 months ago

only because it isnt enforced.

if fines were levied and actually collected, itd be a pretty robust regulation for privacy. theres other issues with it, but nothing that requires gdpr to be wiped out -- just modified (and clarified) a bit.

SyrupThinker• 6 months ago

At the very least it did result in plenty of services that previously didn't allow one to delete accounts to add that option. For other cases writing a strongly worded email did the trick, unfortunate that Nikola did not have as much success with it.

0123456789ABCDE• 6 months ago

thanks for the insight, keyboard warrior

raverbashing2• 6 months ago

Honestly I'd think about several "worse" companies to annoy with such "a test" first than Prusa, but anyway

A company can list an email address as their official GDPR contact in their privacy policy, and if their own spam filter eats your request, it legally never happened. There is no obligation to check. There is no obligation to ensure delivery. The burden is entirely on you to prove they received it.

That's you being silly. The correct way is to send a letter with a Reception Receipt https://en.wikipedia.org/wiki/Avis_de_r%C3%A9ception which is the way lawyers like to do

petcat5• 6 months ago

My understanding is that GDPR is being strongly reviewed with the goal of modeling it closer to what California did with the CCPA [1], which seems to be a much more effective privacy regulation.

[1] https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac...

LunaSea• 6 months ago

Do you know what the primary differences are?

buzer5• 6 months ago

If you mean what they are planning to change (as part of the omnibus) there is report by NOYB https://noyb.eu/sites/default/files/2025-12/noyb%20Digital%2...

If you mean how CCPA/CPRA differs from GDPR there are lots of things. For example you are not entitled to know actual recipients of your data, only the categories. So you cannot really know who actually received your data which then prevents you from exercising your rights against those controllers (or covered entities in CPRA language). GDPR also requires companies to usually notify you if they receive your data as controller (though there are some exceptions), in reality that's not really happening though (e.g. how many payments processors or acquiring banks have notified you about your credit card payments?).

CPRA also allows selling your personal data if you do not opt-out, in GDPR that would generally require consent (except in certain situations where you can use legitimate interest as the basis). GDPR also regulates cross-border transfers a lot more closely as the idea is that the protections & rights travel with the data.

paweladamczuk• 6 months ago

There was a presentation here a while back (last year) about how to avoid getting ignored or played otherwise when submitting those requests. Sadly I cannot find it, but maybe someone else has the link?

tasubotadas• 6 months ago

A flat minimum, say 5,000€ per violation, no matter how small the company, applied automatically when non-compliance is confirmed.

No wonder Europe is such a laggard in tech when even software devs write non sense like this.

One one hand they want independence from the evil US hyperscalers but on the other hand they are ready to kill any new company in the EU.

blell3• 6 months ago

In Spain the fines are like 60k for data protection violations, no matter how small you are, and if you’re self employed, you can’t declare bankruptcy and you have to pay the fine with your own personal assets.

wincy• 6 months ago

Sounds like a great reason to never start a company in Spain, ever.

throwmeaway8203• 6 months ago

why would anyone risk starting a business in such an environment?

fc417fc8022• 6 months ago

Perfect recipe to discourage individuals from innovating. I'm all for holding actual companies with user bases and counsel and insurance and a business model and etc accountable. But "private party just getting started with a bespoke solution was a bit careless or ignorant; luckily no serious harm was caused" should never be financially ruinous.

petcat5• 6 months ago

Many of the "evil US hyperscalers" are headquartered in California, and the CCPA [1] has this exact penalty structure codified in law:

(b) A business shall be in violation of this title if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance. Any business, service provider, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The civil penalties provided for in this section shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General.

$7,500 per intentional violation, $2,500 per unintentional.

[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

konne88• 6 months ago

But it also doesn't apply to small companies:

The CCPA applies to any business, including any for-profit entity that collects consumers' personal data, does business in California (regardless of where it is located), and satisfies at least one of the following thresholds:

Has annual gross revenues in excess of $25 million in its most recent tax year;[11] Buys, receives, or sells the personal information of 100,000 or more consumers or households; or Earns more than half of its annual revenue from selling consumers' personal information.[12][13]

https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac...

mytailorisrich2• 6 months ago

Those numbers are maximum fines per violation if I understand the wording correctly ("not more than") while the suggestion was that €5,000 should be a minimum.

jjp• 6 months ago

Or perhaps they want to stop any company that doesn’t want to play by the rules as defined by the laws of society. So doesn’t matter whether it’s a US hyperscaler or an EU wanna be.

rmonvfer• 6 months ago

You wouldn’t even believe the stuff I’ve heard in “startup” and “innovation” spaces about regulation and stuff like government grants.

I usually hear the “we [europe] have some of the brightest minds, we can do anything” and sure, granted, but that’s not the issue and it has never been. Why would those bright minds want to build something in a place that’s so obviously against the very same idea of free competition? Of course they don’t, those who can just flee and those who can’t usually end up building some useless grant-ware in an endless cycle. That’s not to say that we don’t have great startups and entrepreneurs, we do, but I find myself fighting every day against a system that’s built for the state to decide what, when and how citizens must innovate (and live).

avh02• 6 months ago

Then don't violate it, you won't get fined.

blell3• 6 months ago

This comes from the same website that tells you that the average person commits a thousand crimes every day and that prosecuting criminals is therefore meanie mean.

kstrauser7• 6 months ago

While I love the idea of GDPR, and especially local versions like CCPA that benefit me directly, I loathe much about the GDPR.

1. Cookie popups. Enough said.

2. Its extraterratoriality claims. Yes, I know you also want it to apply to companies in, say, Japan. Bummer. Unless they signed a treaty agreeing to abide by it, their they're own sovereign entities and their businesses don't have to comply with remote EU laws.

3. The annual moderation report. I've lost an aggregate of several weeks of my life filling out reports where 99.9% of our moderation actions were to delete link farms, fake drug sales, phishing portals, and cockfighting fliers.

4. The misperception that GDPR means you have to delete everything. Uh, no. If we suspend joe.scammer@gmail.com's account for phishing, we're not obligated to purge every instance of that email address from our systems, especially not the one that gets to decide whether a new user is allowed to register for another account. And if "joe.scammer" deletes his account, we don't have to return "joe.scammer" into circulation so another user can register it, and simply saying that "joe.scammer is not available" is not disclosing sensitive data. And in any case, a company entirely outside the EU isn't compleleled to do it anyway (see #2).

Love the idea, strongly dislike the implementation.

qkeast• 6 months ago

As far as cookie popups go (and recognizing you probably know this so it’s more a general comment), GDPR doesn’t encode cookie popups into law, but the entire industry follows the pattern of cookie popups in response to the underlying requirement of informed consent. Companies could choose to not collect as much info, or take other approaches, but cookie popups are the default.

causal• 6 months ago

Yeah it's wild we blame GDPR instead of the companies that decide tracking us is worth our inconvenience

SpicyLemonZest• 6 months ago

GDPR does not formally require cookie popups (and the cookie stuff predates GDPR as such anyway). But it's challenging to the point of impracticality to run a website with so few cookies that a popup is not required. The EU's official resources on data protection, for example, have a popup. (https://commission.europa.eu/law/law-topic/data-protection/r...)

kstrauser7• 6 months ago

You're right, for sure. It'd be nice if the law included an explicit exception for local cookies for routine site operation purposes. I haven't put any time into nailing down the wording, but something that communicates "sites are allowed use 'authentication cookies' to validate a user's ability to make server requests" would be most welcome. Then you could actually have an incentive to remove the cookie banner on sites that only use cookies for session authentication. You don't also use them to integrate with your marketing analytics kraken? Sweet! You don't have to have a banner or other notice!

piva00• 6 months ago

Cookie pop-ups are not part of the GDPR.

Every time I read this point on Hacker News I got to point this out because it's an extremely common misconception.

Read the GDPR, at least the outline, it's not there.

matkoniecz2• 6 months ago

Also, cookie pop-ups appeared before GDPR.

Topfi3• 6 months ago

Unless they signed a treaty agreeing to abide by it, their they're own sovereign entities and their businesses don't have to comply with remote EU laws.

What is your opinion concerning laws such as FATCA and other such laws that apply to non-US entities when working with US citizens abroad?

kstrauser7• 6 months ago

Other laws that apply to the US's own citizens abroad, I can kind of get in line with. Like even if you go to a country where murder and mayhem are legal, you can't go there on vacation, rack up a body count, then come back to Wyoming and go back to work on Monday.

Other laws that apply to non-citizens abroad, I'm against, of course. We don't have the moral right to legislate what someone in China can and can't do. However, prosecuting them for that should they enter the US is a different animal. If you run a scam farm and defraud a million Americans, then go to Disneyland on vacation, you should plan on having a bad time. Similarly with GDPR and other EU-local laws: violate them outside the EU, but it'd be wise to skip Barcelona on your next world tour.

fc417fc8022• 6 months ago

Such laws and policies are a blatant overreach. However the US is a superpower so if we act inappropriately smaller economies simply have to tolerate it to a large extent. It's no different than China throwing their weight around with their neighbors.

The EU jumping on that bandwagon was predictable but I don't think it's a good thing. We all ought to strive for a higher moral standard.

dathinab5• 6 months ago

Cookie popups. Enough said.

except a lot of the things related to cookie popups isn't GDPR but other (misguided older) laws

furthermore setting a (proper 1st party and HTTP only) cookie to remember you opted out of tracking doesn't require your explicit consent and as such any side which ask you again and again makes it extra hard to opt out in a way _not legally compliant with GDPR_.

also the do not track flag in a browser is a very clear unmistakable signal from the user that they don't want to be tracked, ignoring it and harassing the user with tracking dialogs is also not GDPR compliant

2. Its extraterratoriality claims.

It's based on your citizens data being owned by your citizens. Extraterritorial claims about your citizens is pretty normal. And only enforced things matter so basically it only matters if they do business in the EU. And requiring someone who does business in another country to comply with that countries laws is the norm. Just because you do it "through a website" doesn't mean you can doge responsibility. That would be absurd.

3. The annual moderation report.

if it's moderation deletion then that isn't GDPR but other laws, and the reports which are needed for GDPR can be trivially automatized.

4. The misperception that GDPR

any half way serious source is pretty clear about that and there isn't much law makers can do if people are to dump to read and then insist they know better

The main issues is still enforcement, or the systematic lack of it in all kinds of ways.

Due to that bad companies don't try comply with GDPR but with "what level of systematic intentional GDPR violation can we get away with" and that in turn leads to legal unreliability/unclear-ness.

Oh and that some business models are inherently incompatible with it and instead of judges being like "bad luck you had years to adapt" they are often hesitant to do much about it (like "pure abos" which deceive the end-user (and judges) with a false dichotomy about ads vs. no ads when the laws is about tracking vs. no tracking and you can have ads without tracking, just not google ads but that is a googles made problem not a fundamentally one).

mhitza2• 6 months ago

Unfortunate. I've had good success rate with smaller companies, whereas I still have an open email chain with Deezer and Glovo in my inbox because their process required to much back and forward (Deezer was particularly stupid because while I had an active trial they couldn't delete my account).

I think the bigger problem is that the entire process is left up to the invidual, to both deal with the vendors (sometimes having to scavange the privacy policy for an email address, or follow multi step processes) and report to the local DPAs. And the local DPA could have as arbitraty rules for the process, and very involved form fillings.

It doesn't help when institutions smell as corruption, as likely seen in Ireland, where it took them almost 8 years to resolve a complaint against facebook and fine them.

Only line I always want to see go up https://www.enforcementtracker.com/?insights

graemep• 6 months ago

That is unfortunate as its more important to enforce the law big companies, especially those who trade data.

gib4443• 6 months ago

Criticism of the EU always gets down voted here but this on point. The EU does too much trumpet blowing.

Too much gets put into law/regulations and then ignored without any kind of retrospective with regards to undesirable effects and efficacy.

Companies have realised GDPR isn't really anything to be feared in reality. Don't quote issued fines at me - quote fines that have been actually paid at least (you'll find that harder to Google)

briandw3• 6 months ago

One could argue that the intention of the law is to make it possible to collect revenue from non-EU companies. Since the EU doesn't have any sizable internet companies. Not counting Prosus group as they are a holding company, Spotify is the biggest at 100mm. EU doesn't care about small / midsized companies because they don't have enough income to bother with. "The purpose of a system is what it does".

Y-bar3• 6 months ago

EU doesn't care about small / midsized companies because they don't have enough income to bother with.

I am so very tempted to quote you sarcastically using mixed upper lower case text for how incredible wrong you are. Yes, there is less enforcement than I want of GDPR, but any insinuation that they do not bother is a lie.

Here is your proof:

https://www.enforcementtracker.com/

latexr10• 6 months ago

Criticism of the EU always gets down voted here

The Chat Control threads are an easy example to demonstrate otherwise.

gib4443• 6 months ago

Sure, pick the weakest part of my comment to reply to because I was imprecise in my language

citizenpaul• 6 months ago

Until there is legislation to simply ban data mining/reselling no companies are going to stop. The benefits to selling you out are simply too profitable and ignoring the hand slap laws/fines stops no one.

The biggest hindrance is that there is ZERO government desire to reign this in. Why? Because the government itself is one of the biggest customers of this data.

The government "fines" the company and immediately comes right back around to the checkout line and hands the same company piles of money for the exact same data they just fined them for selling. The company then just raises the price to make up the difference. I don't see any of this changing in the next 50 years.

gwbas1c• 6 months ago

It could be worse: You could be in the US, where companies can buy and sell your personal information without consequence.

munchler• 6 months ago

I would suggest the US is slightly better. At least we don’t have an unenforceable law that offers the illusion of privacy protections.

ejpir• 6 months ago

how is having NO law better? I'd say 12 out of 20, is better than zero.

datsci_est_20152• 6 months ago

There’s an implicit assumption in this snark that the only purpose of a law is to create legal consequences (a subclass of error that’s very common on this forum, some type of “literalism”).

This is IMO a bit shortsighted: laws impact culture, laws represent ideals worth striving for, and in a democracy, laws help define the type of society in which the people would like to live.

A law’s utility is not limited to its ability to be enforced. In fact, in a democracy, when a law is not enforced, it is a strong signal that the will of the people is not being carried out by those charged with enforcement. See: the current USDOJ.

throwmeaway8203• 6 months ago

A flat minimum, say 5,000€ per violation, no matter how small the company

It's hard to imagine a practice more hostile to starting and operating a business than such a policy

mattjhall• 6 months ago

If you open a business you should be responsible enough to comply with the laws. A business that became large enough where this would become a time sink would be able to afford to hire someone.

jbverschoor• 6 months ago

And why not make the fines 0.1% - 1% of a venture's revenue? Because that's what you're talking about.

y422• 6 months ago

can you explain why? I mean a company ignoring common and simple rules of law... why you want to "protect" that?

raverbashing2• 6 months ago

You really think mom & pop business that have limited IT skills have 5k laying around for some minor violation like not deleting an older email?

matkoniecz2• 6 months ago

" simple rules of law..." - sadly, EU regulations in their totality are far from simple

goshcoding• 6 months ago

How is a fine for mishandling personal information "hostile" to business?

A true Hacker News and YCombinator moment.

michaelsshaw• 6 months ago

Not allowing reckless disregard for the rights of people = literally fascism.

testing22321• 6 months ago

It gets in the way of ever increasing profit. The most important thing ever.

nilslindemann• 6 months ago

Yes, especially as the company could just implement a button "Delete your data" on their website. An automated task initiated by the user. No work for them.

Companies could also make clear before any registration, on one page, which data they will ask for and later collect. If they were honest. Then the user had a chance to opt out _before_ they have given any data to them.

Well, they are not honest, because what do they do instead? Page 1: "Please, your E-Mail". Page 2: "We also need your phone number (we may call you)". Page 3: "Great, nearly done. Now please, your address, your credit card, a fingerprint copy and a picture of your penis".

I am in favor of appending a zero to those 5.000 Euros.

Apreche• 6 months ago

If compliance is so difficult for a business that they will fail if the law is enforced, good.

petcat5• 6 months ago

California has the exact same penalty structure in the CCPA:

(b) A business shall be in violation of this title if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance. Any business, service provider, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The civil penalties provided for in this section shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General.

$7,500 per intentional violation, $2,500 per unintentional.

[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

patja2• 6 months ago

But the California law only applies if your business has more than $25m revenue or does a lot of selling of PII. See SEC. 9. Section 1798.140 in the page linked.

WheatMillington• 6 months ago

All you have to do is respect the law and respect your customers. Absolutely the most basic thing we can ask of a new business.

7bit4• 6 months ago

The issue lies somewhere in between.

I agree that businesses who unlawfully sell your data or do not implement a minimum of security measures should be punished hard.

I also agree that a flat 5000 € is problematic. Not because I believe that breaking the law shouldn't be punished. It's because you also get punished if you protect the data and respect your customers, but you don't document the thousand things you must document as a small business.

I don't know if you ever looked at GDPR, but that does not distinguish between a company with five employees and 50,000 employees.

The company with 5 employees must exactly (!!!) implement the same audit trail and processes that the 50,000 employee company has to do. Or worse, there's literally no difference between you founding a company and Facebook.

This shit gets extremely overwhelming extremely fast and that's just killing small businesses.

ivan_gammel• 6 months ago

Privacy by design is easy. If you are incapable of dealing with GDPR, don’t start a company, because you lack survival skills amyway.

mystraline• 6 months ago

Are there citizen punishments that can be levied when a company refuses the law?

For example, you put in a GDPR deletion request. Company ignores or otherwise does not comply with the law. Can you sue them directly over that?

In the USA, Ive seen a lot of various laws like CAN-SPAM act. But there are no remedies for citizens who were spammed to get statutory damages for being violated. Having that option to get money for being wronged would solve these sorts of problems.

unbalancedevh• 6 months ago

This kind of failure-to-enforce is endemic to government. Oversight and enforcement are implicitly expected of well-regulated governments, and that costs money that nobody wants to pay. Laws get enacted with little thought to how much it will cost to administer them, and they either get underfunded or added to the list of government bloat.

There is no easy way out. The oversight to ensure that governments do what they're expected to without corruption costs real money. We haven't yet figured out how to balance good government with fiscal efficiency; but it would at least be an improvement if people could be educated on the actual cost of properly implementing a law before it gets voted on.

As usual for cases like this, the only chance for a person to force compliance is to have enough money/resources, putting it out of reach for the general population.

tpxl4• 6 months ago

We have figured out how to get money to enforce paying taxes and GDPR compliance: Pay them with the taxes and fines. USA's IRS has a famously high ROI, and I'm willing to bet a single GDPR fine for Google/Facebook/Microsoft pays for a whole lot of GDPR enforcement.

ryandrake• 6 months ago

In general, when it comes to enforcing laws on normal, individual people, governments seem to have no problem finding and cracking down on you. When it comes to enforcing laws on the rich, or corporations, suddenly the kid gloves go on and the "but we're simply not funded for enforcement!" excuses emerge...

lo_zamoyski4• 6 months ago

While enforcement and the cost of enforcement is an important consideration, I would say that there is still value in unenforced law and regs. They set an expectation and a norm.

xboxnolifes• 6 months ago

Sometimes. Other times they create an environment where the only rational action is for everyone to constantly break the law, allowing for selective enforcement.

spwa4• 6 months ago

This is one problem, but in the GPDR's case it's worse: the law is designed for governments. The only people who can actually take action based on the GPDR ... are NOT the courts (same with the AI act btw).

Which governments have immediately used to:

1) exempt themselves from GPDR (e.g. allowing the use of medical data in divorce cases, and then refusing deletion of medical data from public institutions "for that reason". Then of course this was extended to tax enforcement (some of you European bastards DARE to try to get dental treatment when owing back taxes! Some things CANNOT be allowed)

2) they used it to attack certain firms for entirely reasonable reasons. One example, one of the very first cases, before the law was even in force was against Google. You see there are some online articles about José Manuel Barroso, the communist non-executive chairman and senior adviser of London-based Goldman Sachs International (yes, really, communist, not a joke), ex-socialist, then EU commission president ... that according to him violate the "right to be forgotten" (which technically doesn't apply to public figures, but apparently EU commission presidents aren't public figures)

There were some articles he wanted deleted about how technically he is (was?) a murder suspect (he organized and participated demonstrations where some people were killed by a mob that he was part of, and probably the leader of), and how there were complaints against him by his students that allege he beat them up (as in physically), apparently in arguments about financial systems (yes, even when he was a pretty extreme communist he was a professor). He couldn't get the articles deleted ... and so he wanted them hidden. He got what he wanted, without court involvement.

mytailorisrich2• 6 months ago

Deletion requests are a bit fuzzy. Withdrawing consent is easy, some deletions are easy but we need to remember that the GDPR have a carve out "for the establishment, exercise or defence of legal claims."

In practice this means that companies will keep data, and are entitled to keep data, for the period a legal claim may be made. For instance in the UK that period is 6 years and so you will find that companies will keep data for 6-7 years.

y422• 6 months ago

That’s essentially what I’ve experienced, call it 'anecdotal evidence.'

I had a long, ongoing, and very upsetting interaction with a bigger German company. Since I have experience in data privacy and GDPR, I eventually started thoroughly crawling their entire online presence for infringements. I found a significant number of issues and compiled a very extensive report. At first, they were completely dismissive. It was only after I issued formal legal warnings that an actual lawyer contacted me and promised to fix the issues.

Most of the GDPR violations were simply sloppy, though some were genuinely ignorant. It’s wild that we are eight years past 'Year Zero,' and while everyone is constantly talking about data privacy, these gaps still exist.

Some of them eventually has been fixed after my report, silently of course. phhh...

buzer5• 6 months ago

On the "German DPA can only forward it to Czech DPA" there is now regulation (2025/2518) around the cross-border enforcement and as far as I understand it actually has hard deadlines. However it will only start being in effect around May 2027 and will only affect cases which were filed after that. It is still very long process and does require that the original DPA actually initiates things.

The spam filter loophole is unlikely to be legal. It it contrary to other DPA rulings (like Norwegian DPA ruling on Mowi ASA), EDPB guidelines don't strictly define it but I would say tilt towards that excuse not being sufficient & my understanding is that there are also some court cases from Germany and Austria that treat messages routed to spam as recieved (https://www.nospamproxy.de/en/emails-in-spam-folders-are-con...). Of course if you want to actually enforce it you would need to appeal the decision in court, I have no clue how easy or hard that is in Germany.

loorke• 6 months ago

I'm a German citizen

Of course, who else would complain about this.

When my ex-wife just moved to Germany, she was extremely anxious about waste sorting. She spent an hour sorting trash according to video guides on YouTube. Regardless doing everything perfectly, some German neighbor snitched on her to her landlady. Then some other old neighbor was watching through her windows with binoculars (privacy my ass!). Germany is a terrible country, the sick man of Europe once again

Ylpertnodi3• 6 months ago

Two neighbors do not a country make.

Confiks• 6 months ago

As the DPA indeed doesn't function for these kinds of cases, it's also possible to involve the courts and get a legal remedy (i.e. sue them). In The Netherlands that's possible with a 'complaint procedure' in the case of GDPR rights, which is more forgiving on the process (it starts with a not-too-formal letter to the court instead of a summons) and allows for representing yourself. Maximum costs would be somewhere around € 2500 if you lose, € 0 if you win (disregarding all the work and effort that cannot be recouped).

Of course this really isn't something you'd want to do for these kinds of simple cases. But threatening to do so often goes pretty far. The court in the country of the data subject has jurisdiction, so any company operating from another country would need to defend themselves abroad, which can be a strong incentive to cooperate or settle the case.

I've gotten results for GPDR article 20 requests (data portability) multiple times after some strongly worded letters (Spotify [1], NLZiet, AliveCor and Albert Heijn), and have gone to court twice. Once won against Eneco (although that was only about court fees they didn't want to pay without an NDA), and once didn't lose but regrettably didn't win on a quite complicated case against ABN AMRO in which the court just didn't understand what machine readable means despite the clear guidelines by the EDPD.

[1] https://news.ycombinator.com/item?id=24764371

I made 20 GDPR deletion requests. 12 were ignored

Related Stories