this post was submitted on 14 Oct 2026
188 points (95.2% liked)
Technology
89137 readers
3607 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
"Yeah, hi, I have a gdpr request, all the data you have on me, delete that."
We sold it to a third party you'll never find that shares it back to us for free as part of the contract we have with them.
So we don't have any of your data.
So you pay because you have my data without any reasons and because you sold them.
I don't have any data. A third party has your data. But you don't know that.
You said that the third part shared my data with you after you sold them to them, this means that you have my data.
Access to data isn't the same as having data. You can watch a YouTube video but that doesn't mean you downloaded it and have it.
True, but then the data about me you have are useless if you only look at them.
There is no way that you get my data, you sold them to a third part (and here you are already at fault), this third part then share back the data with you for free and then you do nothing with my data, which you asked to begin with. Seriously ?
And I forgot, the third part is at fault too because they have my data without any reasonsand if they get caught they pay a hefty fine.
Marketing data is always kept close by the owners but they sell access or the data would be worthless.
If the original company wants information about you, they don't download everything from a marketing company. Like using Google, you type in your search and get a result. That search result is used and forgotten. You don't have to download all of Google to use the results.
The 3rd party wouldn't be fined because if you knew who they were, you could send them a Gdpr and they would respond. The problem is knowing who these companies are.
So your scenario is moot.
The starting point is that company A get my data, then sell them to company B that then share them for free back to company A.
If the original company want my informations, it need to ask me the informations (and only the ones needed for the transaction) declaring the use it will do of such informations.
If the original company "googled" my informations, use them to contact my or to try to sell me something, I can ask where they get them and the answer cannot be "we googled them around". That is why the GDPR ask for an explicit consent to share personal informations with third parties.
There are special cases, like a company need to share information with a payment gateway or to retain information for a longer period as dictated by some other laws, but generally a company, without an explicit permission, need ask only the information needed for the transaction and to keep the informations only the time it need to complete the transaction. And even with an explicit permission it can not keep the information for more that a given number of years (3 if I remember correctly) without asking for permission again with the default as "if I don't answer, my answer is no".
Your starting point is that I don't know who the third part is and I don't know my data were sold.
But te 3rd party would be fined if they were found with my data without being able to offer my persmission to have them when asked.
The GDPR state that any company must list all the 3rd parties it shares data with.
They don't have to tell you shit, and they don't. Only in CA do they even tell you if your information was stolen, unless it's going to come out in the news and they don't want to look like what they are.
Worst case, if they got prosecuted, they'd negotiate a fine and not admit responsibility so no one could use the government's case for a civil suit.
"Yeah, OK, done, (LOL)!"
does anyone truly believe they respect those delete requests?
Not the US-based companies, no. But occasionally they get some interesting fines when breaching GDPR, and that does seem to cause some adherence. I'm just happy to live in EU.
Add "make no mistake" at the back willil increase the chance they follow through your delete request.