How does Facebook justify non-compliance with GDPR subject access requests?
<p>At first when Max Schrems started doing it they complied in good faith completely.</p>
<p>Now they don't. Do they have some legal theory or workaround as to why they were required to back then but no longer now?</p>
<p>Any other thoughts or considerations on the phenomenon also welcome.</p>
<p>References: <a href="https://ruben.verborgh.org/facebook/" rel="nofollow noreferrer">1</a> <a href="https://thedataprivacygroup.com/blog/facebook-refuses-subject-access-request/" rel="nofollow noreferrer">2</a></p>

<p>As reported (non-authoritatively i.e. not via Facebook itself) <a href="https://thedataprivacygroup.com/us/blog/facebook-refuses-subject-access-request/" rel="nofollow noreferrer">here</a>, it is because data could be used to signify medical history, sexual orientation or religion, data which are deemed highly personal and sensitive information. Whether or not the authorities accept this reasoning can only be determined in court.</p>

gdpr privacy european-union ireland