gdpr data-ownership
How does GDPR deal with combined personal data?
<p>There is a person named <em>aa 1</em> where <em>aa</em> is their first name and <em>1</em> is their surname. Now some other person makes an email named aa.1@somemailingcompany.com. Whose personal data is this? aa 1's or that other person's? How is a request from the real aa 1 answered then to access the email?</p>

<p>I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about <em>some</em> of their data held by <em>some</em> institutions, depending on the legal basis for the data processing.</p>
<p>One <em>John Smith</em> does not have the right to see the data of any other data subject named <em>John Smith</em>, and he cannot even demand to know if there <em>are</em> other <em>John Smiths</em> in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account <em>jsmith@sample.org</em>, one can assume that he is the John Smith who opened the account. If not, then not.</p>
<p>If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?</p>
