[Profile picture of Ruben Verborgh]

Ruben Verborgh

Email: Re: Contact the Data Protection Officer (DPO) #[case-number]

From
Ruben Verborgh <ruben@verborgh.org>
To
Facebook <case++[case-code]@support.facebook.com>
CC
Stephen Deadman <stephendeadman@fb.com> and a couple of others
Date
1 April 2019 at 19:05:50 GMT+2
Subject
Re: Contact the Data Protection Officer (DPO) #[case-number]

Hi “Alex”,

So you mean that mailing senior leadership actually helps? Sweet, then I’m putting them in CC to further expose your unlawful actions. Let’s see how far it gets me this time.

Did you see Mark’s latest joke in the Washington Post on 30 March? He pretends to be begging for more regulation, including laws to facilitate data portability. Kind of ironic, isn’t it, if he even cannot respect existing legislation like GDPR?

But it seems like you had fun too, trying to make my request sound like an unreasonable demand. I also love how you keep on quoting all your data, as if I said something ridiculous that I don’t even understand.

On the contrary, I gave you a very specific list of things I need. Your fancy tools only give me a small part of that. And let’s not pretend that it’s a big cost to you: getting the listed data about a single person is about the simplest query you can write. (Did I mention I’m a data scientist?)

In May 2013, I met a colleague of yours from Marketing at the World Wide Web conference. With one SQL query, she could show me exactly how much money my profile had made Facebook the previous year. It was 7 dollars or so. I’m pretty sure what I’m asking for now is much easier.

Even a non-lawyer can see that your derivation is incorrect:

At its most basic, this means that the information Facebook provides in response to a request should be capable of being understood by the average person.

Nope, the law says

a concise, transparent, intelligible and easily accessible form, using clear and plain language”

so this means it’s your job to simplify where needed, not to make up excuses that you don’t want to simplify. What exactly is so hard to understand about, let’s say, my GPS data you are storing?

So no, I do not appreciate your smoke and mirrors. You are deflecting with your nonsense about raw files and technical data. I am not your average person. How on earth could I validate lawfulness if you only give me the information I put on there myself?

You are depriving me of my most basic data rights. I have asked for the following data, and I am asking you again.

This is a GDPR Subject Access Request. My request explicitly includes any other services and companies for which you are the controller as defined by Article 4(7) GDPR. This request covers, but is not limited to, the following:

Provide all of the above to me, within one month, in a structured format.

Best,

Ruben