Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don&#39;t comply?
<p>So, I've been receiving a lot of spammails recently and I'm pretty fed up with them.
I've also been wondering, how they got access to my mail-address, so I sent a request of information so I can see, what data they store about me, where they got it from and whom they sent it to.
Could I sue the company behind the scam, if they don't comply the GDPR?</p>
<p>(Please excuse the bad English, I'm not a native speaker)</p>

<p>Sure, you can make such a request, but its not likely to help you.</p>
<ul>
<li>Scammers are criminals and don't generally care about GDPR compliance.</li>
<li>Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU.</li>
<li>GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.</li>
</ul>

<blockquote>
<p>I've also been wondering, how they got access to my mail-address,</p>
</blockquote>
<p>Probably just randomly generated. Or, maybe bought from an address seller.</p>
<blockquote>
<p>so I sent a request of information</p>
</blockquote>
<p>This is great! Now they know that there is an actual human being behind that email address, which makes the address much more valuable. Now, the address sellers can charge a higher price for your address, and the spammers know to focus on your address.</p>
<blockquote>
<p>so I can see, what data they store about me, where they got it from and whom they sent it to.
Could I sue the company behind the scam, if they don't comply the GDPR?</p>
</blockquote>
<p>Yes, you can sue them if they don't comply, <em>IFF</em> you can figure out who they actually are.</p>
<p>Provided that you can figure out <em>whom</em> to sue, you will probably win the lawsuit. However, unless they are a EU citizen or have assets within the EU, there is nothing the courts or authorities can do to force them to comply.</p>

gdpr