The new European General Data Protection Regulation (GDPR) came into force some time ago. But have you ever tried to access your private data from large companies like Amazon or Facebook? We conducted a self-experiment and requested our data from Google, Amazon, WhatsApp, Facebook, Instagram, and Apple.
How can you view your data under GDPR?
The EU Data Protection Regulation gives you the right to control what happens to your data and what data is stored about you. Generally, data should only be stored for as long as necessary, and only data that is absolutely essential should be collected.
As a consumer, you also have the right to receive a copy of your data. The request can be made informally, by post, or electronically. You do not need a template or sample for this. The company should then respond within one month. And it must be possible, among other things, to have this data deleted. More detailed information is available, for example, on the website of the consumer advice center:
Many large companies have pre-filled forms for data access requests, which are intended to make it easier for the user. In practice, this looks like this:
- Google: Simply go to https://takeout.google.com, enter your data, and wait.
- Amazon: With Amazon, the process is more complicated. Under "Contact," select "Other" as the reason, then "Request data privacy information." And wait…
- WhatsApp: WhatsApp has a direct function in the app under "Settings," "Account," "Request Account Info."
- Facebook: If you are logged in, you will find the option "Download a copy of your Facebook data" under "Settings," "General Account Settings."
- Instagram: Simply confirm your email address at https://instagram.com/download/request/, then "Request Download." And wait…
- Apple: Log in at https://appleid.apple.com, select "Manage Data and Privacy," and then "Request a copy of your data."
Does it really work?
We dared to try it ourselves and requested data from all companies.
With Google, we were pleasantly surprised, and the data was astonishingly available for download within a few hours. We were less pleasantly surprised by the data collection frenzy of the internet giant: We received thousands of pages of search terms, including image searches and map service searches. You get a location history, and at least we were surprised by everything that was recorded there. Purchases that are listed are very alarming: hotel bookings, flights, purchases on Amazon, and more. You wonder where all this data comes from. And a little tip: Don't print the data. It's really vast amounts of data!
With Amazon, the request is more difficult. First, you have to confirm by email that you really want to make the request. Then more emails are exchanged, and eventually, an announcement came that all data would be available "soon." Some data can also be viewed directly and at any time online on Amazon, for example, all stored data from Alexa or information on personalized advertising. For the more interesting things, Amazon took a bit longer. In some forums, you read that this data is sent via USB stick. We received this data as a download after about four weeks – however, all information is only available for download for about 90 days. But the data itself is substantial: all account information, the complete communication history, all previous orders, all returns, everything that has ever been read or played on registered Kindle devices. Interestingly, all used search terms are only listed since 2017.
With WhatsApp, you can download your personal data package after a few days. The data is surprisingly sparse: profile photo, your own number, the numbers of all contacts, and the names of all chat groups you participate in. No chats, nothing.
With Facebook, the data is also accessible within a few hours. All companies in the Facebook group are truly exemplary in this regard. However, Facebook's own data collection frenzy is much more comprehensive than with WhatsApp and Instagram: everything that Facebook believes might interest the user is listed. In addition, all uploaded photos, videos, messages, and comments are listed. Additionally, every login to Facebook, with date, time, and IP address. This gives you an uneasy feeling about what would happen if someone were to obtain this data.
Instagram is also fast. After a few hours, you receive a file with all uploaded photos & videos, all searches, all your comments, and likes. Very exemplary.
With Apple, a download link arrives via email after a few days. You receive information about all your previously used phones, the internet pages accessed there, email addresses contacted, information about calls, and various location details. This also leaves an uneasy feeling.
Conclusion: All companies react at least very quickly. With Amazon, it took a bit longer, and we only received access to the data after a few weeks. Some of the data collected by Apple, Amazon, Facebook & Co. is at least questionable. Why does Apple need all contacted email addresses and all website visits? How does Google get information about purchases? You wonder what justification these companies have for collecting this data…
And one last small tip:
Only enter data on the internet that is absolutely necessary. And if possible, disable automatic data collection, e.g., of locations.
