this post was submitted on 24 Aug 2023
293 points (98.3% liked)

Privacy

31991 readers
884 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

Last week I received an email from Meta Plattforms Inc about their new ToS and Privacy Policy addressed to my first Name.

But I don't have any accounts on any services from Meta Platforms (I deleted them a few years ago). Therefore I contacted the DPO and requested a copy of my personal data and asked them to delete it according to GDPR.

They told me that there is no account associated to my email, I should provide my account details to the account in question, which I don't have. They are unable to help me with the data I provided and I should contact the irish or my local data protection authority and bring my claims before court.

So they obviously have at least my first name and my email address and refuse to comply with GDPR.

Has anyone had any simmilar experiences or any recommendations on my further actions?

I don't have the time and money to sue Meta, but I will contact my local data protection authority.

top 24 comments
sorted by: hot top controversial new old
[–] Crakila@kbin.social 51 points 1 year ago (2 children)

And water is wet.

Meta has never and will never comply with GDPR in any capacity and the Irish DPO will be more than happy to dish out more fines if stuff like this comes to light.

[–] Navarian@lemm.ee 18 points 1 year ago* (last edited 1 year ago) (1 children)

Meta and however many other of the giant tech companies.

Often it's cheaper for these services to take fines than it is to change up their operation, by an order of magnitude.

Sidenote - Hey, been a minute.

[–] blue_zephyr@lemmy.world 10 points 1 year ago* (last edited 1 year ago)

GDPR fines can scale to a company's yearly revenue. They can absolutely get in more trouble than it's worth if they keep blatantly shitting on the GDPR. Keep reporting them whenever you see these violations.

[–] hddsx@lemmy.ca 3 points 1 year ago

Water has the ability to make things wet but is not wet in and of itself.

[–] MummifiedClient5000@feddit.dk 42 points 1 year ago
[–] PlasmaDistortion@lemm.ee 33 points 1 year ago (1 children)

I received the same email and also deleted the account about 9 years ago. They absolutely are keeping account information.

[–] doom_and_gloom@lemmy.ml 5 points 1 year ago* (last edited 1 year ago)
[–] Ubermeisters@lemmy.zip 25 points 1 year ago

Yeah I was really disappointed to see that email. They shouldn't have any of my information any longer. Unfortunately I'm a citizen of the United States so we don't have national level protections because our country doesn't give a fuck about our information security or privacy

[–] CameronDev@programming.dev 11 points 1 year ago (1 children)

Are you sure it wasn't a phishing email? With stolen creds?

[–] steersman2484@sh.itjust.works 17 points 1 year ago (1 children)

This was the sender email: notification@email.meta.com

And all links point to meta.com, so no phishing

[–] envis10n@lemm.ee 5 points 1 year ago (2 children)

Check the email headers. You can spoof a sender address

[–] 520@kbin.social 5 points 1 year ago (1 children)

Spoofing a sender while falsifying compliance with SPDIF and DKIM are another matter entirely.

OP, do you know if your email host performs these checks? (The popular webmail services do)

[–] steersman2484@sh.itjust.works 0 points 1 year ago (1 children)
[–] 520@kbin.social 0 points 1 year ago

Then you are probably fine unless you're a high value target. Gmail checks these, and any such bypass would not be burned on a common target.

[–] steersman2484@sh.itjust.works 3 points 1 year ago (1 children)

I know, already done. Looks fine

[–] envis10n@lemm.ee 7 points 1 year ago (1 children)

All good, just wanted to make sure since it wasn't clear

[–] steersman2484@sh.itjust.works 5 points 1 year ago

Thank you anyways for the hint

[–] Atemu@lemmy.ml 8 points 1 year ago (1 children)

Did you have an Occulus account?

[–] steersman2484@sh.itjust.works 2 points 1 year ago (1 children)
[–] Atemu@lemmy.ml 3 points 1 year ago

That might be it. I received an email on my newer email that I did use for Occulus but not on my old one I had used for Facebook stuff where I deleted my account.

[–] goodhunter@lemm.ee 3 points 1 year ago

Facebook leaked my mobile phone, where consequently I get sales calls from the other side of planet. I had deleted my account already 6 years prior. I live in the EU btw. F Meta

[–] Chilly@sh.itjust.works 2 points 1 year ago (1 children)

It seems plausible to me that their GDPR process probably missed some email communication system where the name and email was stored, like a hubspot or something custom. Most places I've seen have a ton of systems with name and email in it, and GDPR processes aren't maintained well across all of the teams using that data.

Not saying it's right, just saying it's possible an account was mostly deleted and the remnants remain in some other tool, and the person you spoke with only knows about their main systems.

[–] steersman2484@sh.itjust.works 6 points 1 year ago (1 children)

Yes, could be possible, but I think this is not acceptable for a company as big as Meta

[–] Chilly@sh.itjust.works 1 points 1 year ago

Agreed it's not acceptable. Unfortunately I don't think GDPR is taken seriously enough. Hopefully at some point the consequences will get better