gdpr
Is a GDPR flashmob legal?
<p>If users decide to run a viral laege scale flashmob to get their data in terms of GDPR from a company, is this procedure legal?</p>

<p>Like, competing who manages to make a request to inform about their data on most days in a calendar year?</p>

<p>It is perfectly fine to exercise your rights under the GDPR, and to encourage others to do so. However, a Data Controller may not have to comply with such requests:</p>

<ul>
<li>Art 12(3): If a Data Controller gets many requests, their deadline for compliance might extend from the usual month to up to three months total.</li>
<li>Art 12(5): Where requests are “ manifestly unfounded or excessive, in particular because of their repetitive character”, the Controller can:

<ul>
<li>refuse to act on the request; or</li>
<li>charge a reasonable fee</li>
</ul></li>
</ul>

<p>There is no clear limit that defines when requests become “excessive”. Some data controllers only give you one free copy of your data per year.</p>

<p>Note that many Data Controllers do not care how often you exercise your data subject rights because the processes are often automated. Where self-service options exist (such as a “delete my account” button) you can be required to use that option.</p>
