gdpr
The GDPR loop of physical mail requests ( Is there a way to stop it ? )
<p>It is confusing how this kind of a malacious person an be stopped:
<br>
A person does this:
<br></p>
<ol>
<li>A GDPR request is sent asking for right to access . The request itself bundles some personal information with it.</li>
<li>Under accountability clause the given recipt of previous request must be kept .</li>
<li>Second request sent because the recipt will contain personal information which is to be accessed by mail physical mail.Basically he wants to access recipt of previous one.</li>
<li>Step 2 is revisited.
<br>
A bussinesses wealth will be drained like this as they cannot claim request is manifestly unfound or excessive as new records are kept after every request. HOW TO STOP IT !</li>
</ol>

<p><a href="https://www.dataprotection.ie/en/individuals/know-your-rights/right-access-information" rel="nofollow noreferrer">Artice §12(5) GDPR limits the right to access</a>:</p>
<blockquote>
<ol start="5">
<li>Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:</li>
</ol>
<p>(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or</p>
<p>(b) refuse to act on the request.</p>
<p>The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.</p>
</blockquote>
<p>A request to request the filing that you acted on their request is already excessive, repeated and frequent requests could be acted upon by taking the not-acting steps or sending an invoice before any action is taken. Also, very frequent requests with overlapping times might be answered jointly.</p>
<p>It would be good to inform the customer in the last answer granted for free, how often they requested information and that any further answer might incur such and such fees for compiling the information.</p>

<p>There are two problems with the proposed scenario: the controller might not be required to retain personal data for requests, and such requests by a data subject would likely count as “manifestly unfounded or excessive”.</p>
<p>What kinds of records the data controller should retain about data subject access requests is up to the judgement of the controller, taking into account the guidance by their supervisory authority. Since there doesn't seem to be EU-wide guidance on this matter, I won't speculate too much what should and shouldn't be part of such records. In general, the data controller should be able to convincingly demonstrate that they fulfilled all data subject requests. This is especially important if the data controller denies a request, since the controller has the burden of proof.</p>
<p>It is also worth considering what personal data should be retained in such records, and for which retention periods. E.g. it might be helpful to erase such records after a year, and to mostly use pseudonymous identifiers. As with everything, the data minimization principle is helpful.</p>
<p>Next, if a data subject makes frequent requests to essentially the same data, with the clear purpose of damaging the data controller by swamping them with busywork, that would definitely fall under the “manifestly unfounded or excessive” criterion. Then, the requests could be denied, or the data subject could carry the costs of fulfilling the request.</p>
<p>However, it is up to the data controller to <em>prove</em> this. Such proof could be in the data subject's letters itself. The records about past requests could also help with proving a pattern of harassment. There is no clear case law on which frequency of data subject requests would be excessive, but it's clear that more than one request per month for essentially the same data is pointless since the controller has a month to respond to the old request.</p>
<p>A data controller that is struggling with borderline-abusive GDPR requests might also want to write down a short policy for dealing with such requests, and discuss their proposed policy with their supervisory authority. Even if the authority charges for official answers, that could end up being cheaper than dealing with a flood of requests.</p>
<p>As a practical tip: when you create records about the handling of a data subject request, include these records in the response to the same access request. This avoids the “problem” that each request generates records that the data subject hasn't had access to yet. Similarly, creating a self-service system for access is cheaper for controllers operating at a large scale.</p>
