Data subject rights: no clear way to ask or delete

The rule

Articles 15 to 22 are the rights themselves. Access is Article 15. Article 17 is the right to erasure, headed “right to be forgotten” in the text. Article 20 is data portability, the right to receive data in “a structured, commonly used and machine-readable format” and to have it sent to another controller where technically feasible. Each has its own conditions, and some have exceptions. Article 12 is about the path that leads to them, whichever right a person is asking for.

The Regulation does not say which channel a company must offer. It names no form, portal or address. What it requires is that the company facilitates, and the EDPB has said what that looks like in practice.

Penalties follow the usual two-tier structure. Article 83(5)(b) places “the data subjects’ rights pursuant to Articles 12 to 22” in the upper tier, with a ceiling of EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. The EDPB adds that unjustified rejections of access requests “can be regarded as infringements of data subject rights pursuant to Art. 12 to 22 GDPR” open to fines under Article 83(5)(b), and that a person who thinks their rights were infringed may complain to a supervisory authority under Article 77 (para. 195).

What PeekWell checks and how

EU-07 asks two questions a visitor could answer in a minute: does the site describe a way to ask for access, erasure and portability, and does the contact route it names actually open?

The scan fetches the public privacy policy and the contact pages the site links to. It reads them for language about each right and for a mechanism to use it: an email address, a web form or a portal. A language model helps confirm that the text describes each right and a way to exercise it. The second question is settled by code: the scan checks that the email link, form page or portal address resolves. A missing right or a contact link that goes nowhere becomes a finding.

The scan does not send a request, fill in a form, write to the address or sign in. It cannot tell whether anyone reads the inbox, whether replies go out within the time limit, or whether the company handles requests correctly once they arrive. Those are the things the Uber and Garante decisions turned on, and they are outside what a visit can see.

The same method runs for UK sites under UK-09, with the UK rules applied. The scan has the usual limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. A rights route offered only inside an account, or only by a phone call or letter, may not show up in a page read. A Passed means the expected wording and a working route were observed on the pages scanned. It does not say the company handles requests properly.

Why it matters for a company

This is a complaint-driven area. A person who cannot reach a company, or cannot get an answer, can complain to a supervisory authority, and the authority then looks at what the company offered. In the Uber matter, which ended in a EUR 10 million fine announced on 31 January 2024 (it also covers findings on retention and transfers), more than 170 French drivers went to a human rights association, which complained to the French authority, which passed the file to the Dutch one because Uber’s European headquarters is in the Netherlands.

The route is also something an authority can read for itself. The Dutch authority described a request form that existed but was hard to find, and an answer that arrived as a file that was hard to interpret. Its chair said Uber should have facilitated drivers, and that this is in the law. The Garante’s record is more ordinary: a request to the data protection officer’s address that went nowhere. When the person wrote again, to the DPO address and two other company addresses, all three messages bounced off the spam filter. Only a message to the company’s registered PEC address got a reply.

The one-month clock in Article 12(3) runs from receipt, so a blocked or unmonitored inbox does not stop it.

Smaller companies and larger companies

Article 12 has no size threshold. The same sentence applies to a two-person shop and to a platform with a hundred thousand drivers.

In a small company the route is usually an email address in the privacy policy, often copied from a template. It may point at a mailbox nobody checks, a former employee, or an address behind a spam filter that treats a stranger’s long message as junk. That is what happened in Italy: the request was left unanswered for a month without anyone deciding to ignore it. There may be no one whose job is to notice, so a complaint can be how it comes to light. The fine was EUR 45,000, and it covered several findings.

In a larger company the problem is more often the shape of the process. Requests may have to go through an account, an app menu or a support ticket, and the form may live where the product team put it, not where a person would look. The data may sit in many systems and come back as an unreadable export. Scale also raises the stakes: the Dutch authority took account of the size of the business and the seriousness of the findings, and about 120,000 drivers were working for Uber in Europe at the time.

How to fix it

1. Say it in the privacy policy. Name each right in plain words: access, erasure, portability and the others that apply. Next to them, give one way to use them that a visitor can follow without a guide.
2. Give the route a visible home. Link to it from the footer and from the privacy policy. A short page titled something like “Your data rights”, with an email address or a form, is easier to find than a paragraph in a long policy.
3. Use a mailbox that someone owns. Create a shared address such as privacy@yourcompany, assign two people to it, and add an autoreply that says the request was received and when to expect an answer.
4. Test the inbox from outside. Send a message from an address that has never written to you, with a long subject and no previous thread. Check it arrives, and not in a spam folder. Ask your email provider to allow-list the address that receives requests.
5. Tell staff what a request looks like. A request can reach support, sales or a social account. Agree who it is forwarded to, and write down the date it arrived, since the one-month period runs from receipt.
6. Re-scan. Run a scan again once the wording and the working route are live. The finding should clear when the page describes the rights and the contact link opens.

Whether a given setup meets Article 12 for your business is a question for your legal adviser, and Peeky reports only what it sees.