Pete Haas
Associate Editor
Loyola University Chicago School of Law, JD 2025

In the wake of heightened awareness around data privacy and protection, regulations like the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) in the United States have emerged as trailblazers. These laws bestow significant rights upon individuals, allowing them to control and protect their personal data. At the heart of these regulations lies the concept of Data Subject Rights Requests (DSRR), also known by a similar name of Data Subject Access Requests (DSAR). This article offers strategies to combat the weaponizing DSRRs while complying with the requirements for legitimate requests.

Overview of data subject rights requests (DSRR)

DSRRs are formal requests made by individuals (data subjects) to organizations (data controllers) regarding their personal data. These requests are a cornerstone of data protection laws like the GDPR, which grants individuals several key rights:

1. Right to access: Individuals can request access to their personal data that a company holds.
2. Right to rectification: Individuals can ask for corrections to inaccurate or incomplete personal data.
3. Right to erasure (right to be forgotten): Individuals can request the deletion of their personal data under certain circumstances.
4. Right to restriction of processing: Individuals can request the limitation of the processing of their personal data.
5. Right to data portability: Individuals can request a copy of their personal data in a commonly used format to transfer to another service provider.
6. Right to object: Individuals can object to the processing of their personal data for certain purposes, such as direct marketing.
7. Rights related to automated decision making and profiling: Individuals can request not to be subject to decisions based solely on automated processing.

Intended operation of DSRRs

The primary objective of DSRRs is to empower individuals with greater control over their personal data. By granting these rights, regulations aim to ensure transparency, fairness, and accountability in how organizations handle personal data. The process generally involves the data subject submitting a DSRR to the organization, specifying the nature of the request—whether it’s for access, rectification, erasure, or another right. The organization then verifies the identity of the requester to ensure the legitimacy of the request, locates and retrieves the relevant data, processes the request, and provides the data subject with the requested information or action within a regulatory timeframe, typically 30 days under GDPR.

Potential for misuse: fishing expeditions, abusive practices and misrepresentation

While DSRRs are designed to protect individual privacy, they can be misused in several ways, posing significant challenges for organizations. In particular, techniques such as fishing expeditions, abusive practices, and misrepresentations pose a threat to an organization’s privacy.

Fishing expeditions: Fishing expeditions involve individuals or entities submitting broad or vague requests to gather information that could be used for litigation, regulatory investigations, or other purposes unrelated to genuine privacy concerns. These requests often lack specific details about the data being sought, making it difficult for organizations to determine the true intent behind the request. Consequently, companies may be forced to invest significant resources into locating and retrieving extensive amounts of data, only to find that the requester was seeking information for strategic or adversarial purposes.

Abusive practices: Abusive practices involve the deliberate misuse of DSRRs as a business model to generate claims for damages or pressure organizations into settlements. Some individuals may submit frivolous or exaggerated requests, hoping to identify instances where the organization fails to comply with data protection regulations. By exploiting technicalities or minor non-compliance issues, these individuals may seek to extract compensation or force the company into a settlement to avoid costly litigation. This type of abuse not only places a financial burden on organizations but also undermines the integrity of data privacy regulations.

Misrepresentation: Misrepresentation occurs when individuals provide false information or identities to obtain data that is not rightfully theirs. This can include using fake names, stolen identities, or impersonating someone else to access personal data. Organizations must invest in robust identity verification processes to prevent fraudulent claims and ensure that the data is only disclosed to the rightful data subject. However, these measures can be resource-intensive and may not always be foolproof, leaving companies vulnerable to potential data breaches and legal liabilities.

Alternative misuse tactics

In addition to fishing expeditions, abusive practices and misrepresentation, the use of strategic litigation and resource draining offer alternative options for misuse. Strategic litigation involves using DSRRs to gain insights into an organization’s data practices and identify potential legal vulnerabilities. Litigants may submit requests with the aim of uncovering information that can be used as evidence in lawsuits or regulatory complaints. This tactic can place organizations under increased scrutiny, exposing them to legal challenges and potential reputational damage. Furthermore, the need to respond to DSRRs in a timely and accurate manner can divert resources from other critical legal and compliance functions.

Intentionally submitting numerous DSRRs can strain an organization’s compliance resources and disrupt operations. This tactic, often referred to as “request flooding,” aims to exhaust the company’s capacity to handle requests effectively. As a result, organizations may struggle to meet regulatory deadlines, leading to fines and penalties for non-compliance. Additionally, the diversion of resources to manage the high volume of requests can impact the overall efficiency and effectiveness of the organization’s data privacy and security programs.

Mitigation strategies

Organizations must strike a delicate balance between complying with DSRR requirements and mitigating misuse. Implementing robust verification processes is a crucial first step, ensuring that the identity of the requester is verified and the legitimacy of the request is validated. This helps prevent fraudulent claims and ensures that requests are genuine.

Setting clear policies and procedures for responding to DSRRs can also help manage expectations and streamline the process. Establishing response timeframes and implementing reasonable fees for processing excessive or repetitive requests can deter misuse and ensure that resources are used efficiently.

Automated systems can play a significant role in managing DSRRs efficiently. By deploying automated workflows, organizations can handle routine requests with ease, reducing the manual burden on staff. AI and analytics can also be used to detect patterns of misuse and flag suspicious requests for further review, helping to ensure that genuine requests are prioritized and handled appropriately.

Educating employees about DSRRs and potential misuse is another vital strategy. Regular training sessions can help employees understand how to handle requests and recognize potential abuse, while awareness campaigns can raise overall understanding of the risks associated with misuse and the importance of adhering to company policies.

Finally, monitoring and tracking requests can help organizations identify patterns of misuse and maintain compliance with company policies. Maintaining detailed logs of all DSRRs and litigation attempts can provide valuable insights, while implementing audit trails can ensure that requests are handled transparently and in accordance with regulations.

Balancing compliance and protection

DSRR are essential tools for protecting individual privacy and ensuring transparency in how personal data is handled. However, their potential for misuse poses significant challenges for organizations. By implementing robust verification processes, setting clear policies, using automated systems, educating employees, pursuing legal recourse, engaging with regulators, and monitoring requests, companies can mitigate misuse while continuing to comply with data privacy regulations. Balancing these strategies effectively will help organizations navigate the complex landscape of data privacy and maintain trust with their customers.