this post was submitted on 13 Mar 2024
20 points (88.5% liked)

Privacy

833 readers
1 users here now

Privacy is the ability for an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively.

Rules

  1. Don't do unto others what you don't want done unto you.
  2. No Porn, Gore, or NSFW content. Instant Ban.
  3. No Spamming, Trolling or Unsolicited Ads. Instant Ban.
  4. Stay on topic in a community. Please reach out to an admin to create a new community.

founded 2 years ago
MODERATORS
c0mmando@links.hackliberty.org
20
Giving fake info can compromise your GDPR access rights (sopuli.xyz)
submitted 8 months ago by freedomPusher@sopuli.xyz to c/privacy@links.hackliberty.org
12 comments fedilink hide all child comments
 

cross-posted from: https://sopuli.xyz/post/10336994

I often give fake info as an extra measure of data protection. If I don’t need the data controller to have my date of birth, I give a fake one.

Well this just screwed me because I made an access request and the data controller said: to verify your identity, tell us your date of birth. Fuck me. I didn’t keep track of which fake date I gave them. I didn’t even keep track of whether I gave fake info. So they could treat my otherwise legit request as a breach attempt.

I should have kept track of the birth date I supplied. I will; from now on.

you are viewing a single comment's thread
view the rest of the comments
[–] morras@jlai.lu 3 points 8 months ago (1 children)

What data controller is that?

Very few of them have a valid ground to process your birh date. Do they need it to provide you the service? No? Then they fail the data minimization requirement.

and refusing access right on the ground of the birth day, which they should not have in the first place, is the cherry on the cake.

Send them a letter to tell thel that you are ready to submit a complaint to your regulator (or the lead regulatior), but that you are ready to compromize to save hassle to everybody. A few thousands are always welcome.

But again, this is valid only if the controller have no ground to process birth date. If it provide adult stuff, or legal benefits, etc. it's a different story.

[–] freedomPusher@sopuli.xyz 1 points 8 months ago (2 children)

What data controller is that?

Grocery store loyalty card. I actually quit all grocer loyalty cards because the 1% savings or whatever is a lousy insignificant amount for being tracked in such detail. And I switched to cash. The grocer’s website started blocking Tor so I started boycotting them and I’m just digging around on the principle that if they don’t have enough privacy respect to serve Tor users then they should be probed.

The whole point of the loyalty card is to do market research. They would likely claim that processing birth date is lawful under Art.6¶1(b) (“processing is necessary for the performance of a contract”). But is it? I mean, buying the food doesn’t even need a contract. One could argue that offering exclusive promos to cardholders does not require any data collection. But it would defeat the grocer’s purpose for entering into the contract. I guess I should read up on EDPB guidelines 2019/02.. that should have the answer.

[–] morras@jlai.lu 2 points 8 months ago

Providing the service is selling groceries, that doesn't require a birth date.

So it's not possible to sneak it under performance of contract. Only Legitimate Interest or Consent could be valid, and you can oppose/retract.

But good readng, please provide our findings, that will save me a reading 😅

[–] c0mmando@links.hackliberty.org 1 points 8 months ago

i use a generic phone number for grocery store loyalty cards -- works every time at any store typically with multiple accounts associated with it