Constantine Karbaliotis, a Canadian Privacy Lawyer has created the mother of all data access requests that a company may receive under GDPR or CCPA. These are the edge cases… but they are the requests that en masse could bring your IT department to its knees if unprepared.
The Nightmare Letter: A Subject Access Request under GDPR
Dear Sir/Madam: I am writing to you in your capacity as data protection officer for your company. I am a customer of yours, and in light of recent events, I am making this request for access to personal data pursuant to Article 15 of the General Data Protection Regulation. I am concerned that your company’s information practices may be putting my personal information at undue risk of exposure or in fact has breached its obligation to safeguard my personal information pursuant to <latest nasty cybersecurity event or thing in the news>. I am including a copy of documentation necessary to verify my identity. If you require further information, please contact me at my address above. I would like you to be aware at the outset, that I anticipate reply to my request within one month as required under Article 12, failing which I will be forwarding my inquiry with a letter of complaint to the <appropriate data protection authority>. Please advise as to the following: (and the request follows)…
The Nightmare Letter: A Subject Access Request under GDPR on LinkedIN Pulse
California Dreamin’: Nightmare DSAR from the West Coast
Dear Sir/Madam: I am writing to you in your capacity as for your company. I am a customer of yours, and in light of recent events, I am making this request for access to personal information pursuant to the California Consumer Privacy Act (CCPA), §1798.110. Optional: I am furthermore concerned that your company’s information practices may be putting my personal information at undue risk of exposure or in fact has breached its obligation to safeguard my personal information pursuant to . I am including a copy of documentation necessary to verify my identity. If you require further information, please contact me at my address above. I would like you to be aware at the outset, that I anticipate reply to my request within 45 days as required under § 1798.130, failing which I will be forwarding my inquiry with a letter of complaint to the California Attorney General. Please advise as to the following: (and the request follows)…
California Dreamin’: Nightmare DSAR from the West Coast on LinkedIN Pulse