GDPR countdown and compliance

Whether the interpretation was sketchy or not is not the point, I think. The question is rather what the data protection agency would do with this case.

The (sample) letter is “merely” asking for all the information that the user is entitled to. The “dangerous” part is what the troll is then going to do with that information (or the absence of a reply): writing a letter of complaint to the data protection authority. That letter would complain either

  • about the complainee not providing the required information or
  • about the complainee not adequately protecting the complainants personal data.

If that letter of complaint ever gets sent (and one might doubt that it will, which is why I find it particularly frustrating that the troll “won” so easily) one might wonder whether such a rather obvious troll case will be prioritized in any way by the authority given that they will have to deal with some serious real cases and given they will make sure to show to the public that their work “makes sense”. Even if/when they deal with the case they will surely consider the severity of the case so that I don’t see how this could lead to any significant fines as long as the forum owner made reasonable efforts to comply with the law. And as has previously been mentioned in the other topic, this seems to be the core of the problem: the forum admin simply couldn’t be bothered. So from that stance, it probably makes sense to close the forum down.

I wonder, though, whether that actually solves the problem. Closing the forum prevents future litigation, but does it prevent the troll from continuing just the same? After all, he still has the right to get that information and, I suppose, the forum admin could still be fined for abuse of personal data during those 30 days or so during which the forum operated under GDPR, no? (Though chances of actually being fined probably decreases further, as damage has been minimized).

4 Likes