In case a company is flooded by &quot;asymmetric&quot; GDPR-related requests (request via email, preferred answer via postal mail), how should a company react?
<p>Concerning the individual's right about information about one's data, <a href="https://gdpr-info.eu/art-12-gdpr/" rel="nofollow noreferrer">Art. 12 GDPR</a> (&quot;Transparent information, communication and modalities for the exercise of the rights of the data subject&quot;), (3) says</p>
<blockquote>
<p>... Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.</p>
</blockquote>
<p>Now if someone askes a company for his data via email (free) and wants to get the answer via postal mail, the company has some cost (letter, print-out, stamp), which is minor, but becomes huge if</p>
<ul>
<li>a large number of people perform such requests</li>
<li>someone with bad intentions sends lost of requests via different emails (easy to generate anonymously) and requests postal mail answers to different addresses which are taken e.g. from some phone book. Here it is nearly impossible to prove that the requests are &quot;unfounded or excessive&quot; as described in (5) of Art. 12 GDPR because they look like coming from a lot of different people. Some <a href="https://www.mydatadoneright.eu/request" rel="nofollow noreferrer">online tools</a> could easily be abused to create such requests (for sure this is not the intention of such a tool, but the whole question came to my mind when I was playing around with this tool in the link).</li>
</ul>
<p><strong>Question</strong>: In case a company is flooded by such &quot;asymmetric&quot; requests, how should a company react? Start answering via email and ignoring the requester's wish to get postal mail?</p>

<blockquote>
<p>In case a company is flooded by such &quot;asymmetric&quot; requests, how should a company react?</p>
</blockquote>
<p>Although article 12.5 refers to singular &quot;<em>a data subject</em>&quot;, it can be inferred that exposing the controller to significant expenses is not part of the legislative intent. Accordingly, the company may have requesters choose between paying a reasonable fee for the ensuing administrative costs or withdrawing the requirement that delivery be by postal mail.</p>
<p>The bad faith scenario you outline seems to be a non-sequitur, since generally a pattern (or a high number) of requests for postal mail delivery should prompt the controller to suspect that some or many might not be legitimate. A requester with bad intentions would be unable to prove the identity of the various data subjects he impersonates or alleges to represent.</p>

gdpr