Thread · 2 tweets · 11 Sept 2018

The GDPR places strong data protection requirements upon personal data controllers. Granting an access request with insufficient validation is indeed a breach of @Spotify's GDPR obligations. If I were them I'd be begging you not to sue.

Having said that it's hard, there's no standard of verification and you have to balance the risks to the person against not making the process so hard you're preventing them from exercising their rights.