Last week I received an email from Meta Plattforms Inc about their new ToS and Privacy Policy addressed to my first Name.

But I don’t have any accounts on any services from Meta Platforms (I deleted them a few years ago). Therefore I contacted the DPO and requested a copy of my personal data and asked them to delete it according to GDPR.

They told me that there is no account associated to my email, I should provide my account details to the account in question, which I don’t have. They are unable to help me with the data I provided and I should contact the irish or my local data protection authority and bring my claims before court.

So they obviously have at least my first name and my email address and refuse to comply with GDPR.

Has anyone had any simmilar experiences or any recommendations on my further actions?

I don’t have the time and money to sue Meta, but I will contact my local data protection authority.

  • Crakila@kbin.social
    link
    fedilink
    arrow-up
    107
    arrow-down
    8
    ·
    1 year ago

    And water is wet.

    Meta has never and will never comply with GDPR in any capacity and the Irish DPO will be more than happy to dish out more fines if stuff like this comes to light.

    • Navarian@lemm.ee
      link
      fedilink
      arrow-up
      35
      ·
      edit-2
      1 year ago

      Meta and however many other of the giant tech companies.

      Often it’s cheaper for these services to take fines than it is to change up their operation, by an order of magnitude.

      Sidenote - Hey, been a minute.

      • blue_zephyr@lemmy.world
        link
        fedilink
        arrow-up
        19
        ·
        edit-2
        1 year ago

        GDPR fines can scale to a company’s yearly revenue. They can absolutely get in more trouble than it’s worth if they keep blatantly shitting on the GDPR. Keep reporting them whenever you see these violations.

    • hddsx@lemmy.ca
      link
      fedilink
      arrow-up
      6
      arrow-down
      8
      ·
      1 year ago

      Water has the ability to make things wet but is not wet in and of itself.

  • PlasmaDistortion@lemm.ee
    link
    fedilink
    English
    arrow-up
    63
    ·
    1 year ago

    I received the same email and also deleted the account about 9 years ago. They absolutely are keeping account information.

  • WhoRoger@lemmy.world
    link
    fedilink
    English
    arrow-up
    47
    arrow-down
    1
    ·
    1 year ago

    I’d say try again but specifically 1) talk to someone who is a designated GDPR officer (they have to have the contact listed), 2) specify that you don’t have an account, but are requesting the information anyway

    Maybe just talking to a different person will get you different information. Most likely support is done by some center in India that is going by an internal faq and so it always depends who you gonna get.

    I mean, them asking you to provide email/info of your account smells of misdirection already (whether deliberate or not), because you don’t have to have an account for them to have your data.

    Recently I’ve been thinking of doing something about emails from a gaming store I’ve started receiving a few months ago, to an email I’ve not been using for over a decade and that’s only been registered to some forums. If I decide to look into that, they need to be able to explain where they got the my contact in the first place.

    • steersman2484@sh.itjust.worksOP
      link
      fedilink
      arrow-up
      12
      ·
      1 year ago

      I did everything you included in your first paragraph.

      I could try again but I don’t know if this makes any difference, at least I read a simmilar story on reddit some time ago. If I remember correctly it was about a person who got banned on Instagram and therefore he was not able to get his data deleted.

      • WhoRoger@lemmy.world
        link
        fedilink
        English
        arrow-up
        20
        ·
        edit-2
        1 year ago

        Well they have to, regardless of account status. If they don’t, then as you say they’re in violation and therefore you can report them to your local GDPR bureau, which every EU country has.

        You don’t have to sue Meta, the bureau has the authority to enforce compliance and give fines for every day they don’t. Dunno how effective it is against entities like Meta, but they’ve been in hot water in a couple countries already.

        Ed: ok I guess it’s important how identifiable the data is. Monoliths like Meta do collect a ton of data which they technically can claim is anonymous… We’ll see how that turns out eventually. But email and name are definitely personal data.

        • blue_zephyr@lemmy.world
          link
          fedilink
          arrow-up
          12
          ·
          edit-2
          1 year ago

          There’s a really low bar for what is considered personal data. If they collect location data coupled to an “anonymous” ID, it’s still personal data, because it shows you moving to your house and place of work every day. If you can infer a person’s identity from the data, it’s personal data.

          So yeah them collecting your personal e-mail address and refusing to delete it is a clear violation of the GDPR.

          • Em Adespoton@lemmy.ca
            link
            fedilink
            arrow-up
            3
            ·
            1 year ago

            And in this case, they demonstrated they held email address linked to first name, and linked to account status. Having all that PII and refusing to both hand it over and to purge it is an open/shut violation. And the only way the fines will scale is if enough people report these violations. Meta counts on most people just ignoring them.

  • Ubermeisters@lemmy.zip
    link
    fedilink
    English
    arrow-up
    45
    ·
    1 year ago

    Yeah I was really disappointed to see that email. They shouldn’t have any of my information any longer. Unfortunately I’m a citizen of the United States so we don’t have national level protections because our country doesn’t give a fuck about our information security or privacy

  • Chilly@sh.itjust.works
    link
    fedilink
    arrow-up
    5
    ·
    1 year ago

    It seems plausible to me that their GDPR process probably missed some email communication system where the name and email was stored, like a hubspot or something custom. Most places I’ve seen have a ton of systems with name and email in it, and GDPR processes aren’t maintained well across all of the teams using that data.

    Not saying it’s right, just saying it’s possible an account was mostly deleted and the remnants remain in some other tool, and the person you spoke with only knows about their main systems.

      • Chilly@sh.itjust.works
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Agreed it’s not acceptable. Unfortunately I don’t think GDPR is taken seriously enough. Hopefully at some point the consequences will get better

  • goodhunter@lemm.ee
    link
    fedilink
    arrow-up
    4
    ·
    1 year ago

    Facebook leaked my mobile phone, where consequently I get sales calls from the other side of planet. I had deleted my account already 6 years prior. I live in the EU btw. F Meta

    • blue_zephyr@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      You don’t have to sue them. Suing a multinational company will bankrupt you. Let the data protection authority handle this.

      • koper@feddit.nl
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        edit-2
        1 year ago

        The DPC is almost certainly going to ignore complaints like this. You can choose between suing meta or suing the DPC.

        • Spawn7586@lemmy.world
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          It’s not the US here, suing is not viable nor easy in the EU. That’s why we created that system in the first place. And it kinda works. It may be slow but they are not gonna ignore complaints at random

          • koper@feddit.nl
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            Have you ever seen the statistics? The DPAs are massively underfunded and the Irish DPC in particular is notorious for ignoring complaints, to the point where the EU is considering launching infringement procedures against Ireland for not properly enforcing the GDPR. If you think they will take action on a complaint like this, you will get disappointed.

            On the other hand, petitioning the courts to intervene is probably easier than you think. In some member states you don’t even need a lawyer, so all it takes is a bit of time and some court fees. I’m not saying it’s the preferred option, but realistically it is the shortest path to a result.