How to effectively evade the GDPR and the reach of the DPA

> someone who threatens their own customer in bad faith (or negligence) just for 30k is likely to be more trouble and of less value to you in the future if that's their focus of increasing revenue.

Yes, that was really strange. We though they might need quick money, as this was right at the beginning of the corona crisis. Still, not acceptable.

> What if they were intentionally feeding rocketreech miss-information?

That's possible but quite strange. This information is public in our country, so there is a known reliable source and they should've known better.

> Obviously there was no way I would pay them but it was extremely difficult to convince them to stop harassing me for this money even though they had no proof.

Yes, this is quite usual. We were seriously lucky we discovered the change; but, given that they backed up so quick after calling it a fraud, I'm seriously assuming it was.

I've always wondered about the practical side of how GDPR is supposed to work for companies outside the EU.

If you've got actual stuff in the EU, it's easy. You get fined under GDPR and if you never show up to argue your side in court or an administrative hearing or whatever, they seize your real estate or bank accounts or physical servers or whatever, and sell it to pay your fines.

If you're US-based, how does it work? Hmm, if you're a modern shop you probably have stuff hosted by big companies, like servers on Amazon's AWS or code on Microsoft's Github. Then the EU could presumably tell those companies to stop hosting your stuff, or they'll become liable for fines as an accessory to the violation. Microsoft and Amazon probably have a lot of bank accounts and physical stuff in the EU that could be seized and sold, so they couldn't simply ignore the fine. They'll probably drop you as a customer immediately once Europe starts making them pay fines, and maybe try to sue you in the US court system to try to recover those costs.

I've never heard of this happening though. So maybe this isn't actually a thing.

If all your stuff is on US soil, and you're careful not to use providers with any European presence, how would they do it? Does the EU have some way to order all European ISP's to blackhole traffic from your company's IP ranges? When your executives come to Europe for vacation or conferences or whatever, could they get hauled off the plane in handcuffs and taken to a European jail over your company's GDPR violations?

Again, I haven't heard of this actually happening. But it seems to me that would be how they'd do it, if they really wanted to prevent overseas companies from simply ignoring GDPR.

If there's no threat of enforcement, why bother with GDPR at all, unless you're planning on having seizable stuff like real estate or bank accounts or physical servers in Europe someday?

I'll be honest - based entirely on your description of events, with no other context, I wouldn't have approved this request either. Here's my reasoning:

> They then asked me to provide my address to confirm my identity...I wasn't keen on it.

This means one of the primary avenues of verification (possibly the only avenue for some shops) is unavailable. In the scope of GDPR, it's important to remember that they aren't allowed to retain any information you provide for this purpose for any reason other than keeping a record of the request.

> I mentioned that my full name is globally unique, but they refused.

I would have absolutely no way to validate this, because I don't have a comprehensive listing of all 7 billion-odd people in the world. Even if I did, and it was, it's still only a single factor - I doubt you'd want me to release your data to anyone else based only on them knowing your name and that it's unique.

> My name is...easily searchable, linked to my personal domain, and my personal email address on that domain

This can't be relied on, obviously, because there's no identity verification on (most) domain registrations. For all I know, the email address that I have attached to your profile isn't even yours (because we have no preexisting relationship, this has never been proven.)

> I tried to ask them to share some masked data that I can confirm in full...They refused.

I don't think this is actually allowed under GDPR, but assume it is. Let's say you do this twice with two different data controllers - they each provide you with a masked address, but they've masked different parts (because there's no standard).

If you were a malicious actor, you'd now have the subject's complete address and could use that to gain access to the rest of their data. It opens up a significant attack vector.

> How on earth am I supposed to give all my address history to a company I never heard of, and who shared my data without my consent...

Assuming this was someone unknown and not Acxiom, this is a valid point and unfortunately I don't think there's a great answer. In this case, it is Acxiom and you could've quite easily discovered that they're a major corporation and not a random data harvesting shop.

> I think I was very reasonable, and they weren't.

At the end of the day, you're going to have to give them something to prove who you are. If you won't even provide your old addresses, then absent a government-issued ID (which I assume you also would be reticent to provide on the same grounds) I don't know how else I would even attempt to conduct verification.

tim

I think you miss the elephant in the room, which is my email address. That's not something that easy to fake, and I'm pretty darn sure they have it in their database.

If they have other details about me, like my phone number or address, they can offer to give me a call, or send a letter to confirm my identity (btw, another company I filed a request with did just that). This won't expose any further details. The fact is, they didn't suggest any reasonable alternative.

> Assuming this was someone unknown and not Acxiom, this is a valid point and unfortunately I don't think there's a great answer. In this case, it is Acxiom and you could've quite easily discovered that they're a major corporation and not a random data harvesting shop.

The fact that they're big is irrelevant. They already shared my data without my explicit consent. They're a company I never ever signed-up for, interacted with in any way, yet they hold data on me. They share it and make profit out of it. I'm definitely not keen on sharing any additional info with a company that aggregates my data as their core business.

I hope you see the huge imbalance here. To get my data I need to jump through hoops and expose even more data about myself (to a data broker which makes money off of it). To sell, aggregate, share and abuse my data without my consent and very likely in violation of GDPR requires no validation that indeed the data belongs to me, nor even an attempt to contact me and ask for consent.