Data subject rights: no clear way to ask or delete

The rule

Articles 15 to 22 are the rights themselves. Access is Article 15. Article 17 is the right to erasure, headed “right to be forgotten” in the text. Article 20 is data portability, the right to receive data in “a structured, commonly used and machine-readable format” and to have it sent to another controller where technically feasible. Each has its own conditions, and some have exceptions. Article 12 is about the path that leads to them, whichever right a person is asking for.

The Regulation does not say which channel a company must offer. It names no form, portal or address. What it requires is that the company facilitates, and the EDPB has said what that looks like in practice.

Penalties follow the usual two-tier structure. Article 83(5)(b) places “the data subjects’ rights pursuant to Articles 12 to 22” in the upper tier, with a ceiling of EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. The EDPB adds that unjustified rejections of access requests “can be regarded as infringements of data subject rights pursuant to Art. 12 to 22 GDPR” open to fines under Article 83(5)(b), and that a person who thinks their rights were infringed may complain to a supervisory authority under Article 77 (para. 195).

What PeekWell checks and how

EU-07 asks two questions a visitor could answer in a minute: does the site describe a way to ask for access, erasure and portability, and does the contact route it names actually open?

The scan is automated. It reads your privacy policy and the contact pages your site links to, looking for each right and a way to use it: an email address, a web form or a portal. It also checks that the route it finds actually opens. A missing right or a contact link that goes nowhere becomes a finding.

The scan doesn’t send a request, fill in a form or write to the address. It can’t tell whether anyone reads the inbox, whether replies go out within the time limit, or whether the company handles requests correctly once they arrive. Those are the things the Uber and Garante decisions turned on, and they’re outside what a visit can see.

The UK version of this check is UK-09, with the UK rules applied. The scan has the usual limits, and the report says so. It sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. A rights route offered only inside an account, or only by a phone call or letter, may not show up on the public pages. A Passed means the expected wording and a working route were observed on the pages scanned. It doesn’t say the company handles requests properly.

Why it matters for a company

This is a complaint-driven area. A person who cannot reach a company, or cannot get an answer, can complain to a supervisory authority, and the authority then looks at what the company offered. In the Uber matter, which ended in a EUR 10 million fine announced on 31 January 2024 (it also covers findings on retention and transfers), more than 170 French drivers went to a human rights association, which complained to the French authority, which passed the file to the Dutch one because Uber’s European headquarters is in the Netherlands.

The route is also something an authority can read for itself. The Dutch authority described a request form that existed but was hard to find, and an answer that arrived as a file that was hard to interpret. Its chair said Uber should have facilitated drivers, and that this is in the law. The Garante’s record is more ordinary: a request to the data protection officer’s address that went nowhere. When the person wrote again, to the DPO address and two other company addresses, all three messages bounced off the spam filter. Only a message to the company’s registered PEC address got a reply.

The one-month clock in Article 12(3) runs from receipt, so a blocked or unmonitored inbox does not stop it.

Smaller companies and larger companies

Article 12 has no size threshold. The same sentence applies to a two-person shop and to a platform with a hundred thousand drivers.

In a small company the route is usually an email address in the privacy policy, often copied from a template. It may point at a mailbox nobody checks, a former employee, or an address behind a spam filter that treats a stranger’s long message as junk. That is what happened in Italy: the request was left unanswered for a month without anyone deciding to ignore it. There may be no one whose job is to notice, so a complaint can be how it comes to light. The fine was EUR 45,000, and it covered several findings.

In a larger company the problem is more often the shape of the process. Requests may have to go through an account, an app menu or a support ticket, and the form may live where the product team put it, not where a person would look. The data may sit in many systems and come back as an unreadable export. Scale also raises the stakes: the Dutch authority took account of the size of the business and the seriousness of the findings, and about 120,000 drivers were working for Uber in Europe at the time.

How to fix it

1. Say it in the privacy policy. Name each right in plain words: access, erasure, portability and the others that apply. Next to them, give one way to use them that a visitor can follow without a guide.
2. Give the route a visible home. Link to it from the footer and from the privacy policy. A short page titled something like “Your data rights”, with an email address or a form, is easier to find than a paragraph in a long policy.
3. Use a mailbox that someone owns. Create a shared address such as privacy@yourcompany, assign two people to it, and add an autoreply that says the request was received and when to expect an answer.
4. Test the inbox from outside. Send a message from an address that has never written to you, with a long subject and no previous thread. Check it arrives, and not in a spam folder. Ask your email provider to allow-list the address that receives requests.
5. Tell staff what a request looks like. A request can reach support, sales or a social account. Agree who it is forwarded to, and write down the date it arrived, since the one-month period runs from receipt.
6. Re-scan. Run a scan again once the wording and the working route are live. The finding should clear when the page describes the rights and the contact link opens.

Whether a given setup meets Article 12 for your business is a question for your legal adviser, and Peeky reports only what it sees.