Data horror stories - 1
To all my data-privacy-protective friends here: something crazy just happened!
I have been testing out this mobile app development platform recently. I understand that their data practices are regulated by the GDPR.
Since I could not configure a domain-related setting on my test project, I contacted their support repeatedly. They finally answered today and set out to fix this issue with me. (Maybe third time really is a charm.)
Their requests for me were to:
- change my login credentials to both their service and my domain management service to dummy ones;
- give both my credentials to them so that they will take a look at my problem from “their” end.
And they were nonchalant as hell.
I wrote them this was not going to happen and I was going to screenshot our conversation and share it online after blurring out their name. Then I paused. What the hell is really going on?
Photo by Bernard Hermant on Unsplash
They explained that they are forbidden by the GDPR to look through my personal data on their back-end. But they did not think twice when asking for my login credentials to their and not-their services.
This is an example of a workaround of strict laws annihilating the original intention of the said laws. It could be that the regulations are misplaced or too tight, or the regulated willing to do anything as long as they are “within” the lines, or I am just overreacting.
In my opinion, big or small, these ethical issues and implications of our everyday digital lives should be noted carefully and discussed widely.
How would you have reacted? Does the GDPR leave this little room for appropriate data conduct for businesses? How does your company resolve issues for your customers following the GDPR?
Is this just one bad case of carelessness or is this actually considered normal? Would you have asked for your customers’ credentials even to solve their problems, even if it is the most convenient way somehow? What would you have done?
Honestly, these kinds of horror stories keep me up at night.