What You Get When You Ask A Company For Your Data

Several states now give residents a right to request a copy of the personal information a company holds about them. What arrives is informative in two directions: what was collected, and what the law allows a company to withhold.

The request has to be verified first

Handing over a file about a person to whoever asks would itself be a breach, so companies must confirm the requester is who they claim to be.

Verification standards scale with sensitivity, and for the most sensitive categories a company may require a signed declaration or a government identifier.

This creates the awkward situation where exercising the right can require providing more identifying information than the company previously held.

Scope is defined by statute, not by expectation

Access rights generally cover personal information the business collected, the categories of sources, the purposes, and the categories of third parties it was shared with.

Inferences drawn about a person are included in some states, which is where the interesting material usually is, since profiles are built from behavior rather than from anything you typed.

Trade secret protections let companies describe scoring or segmentation in general terms rather than disclosing how a category was derived.

Exemptions remove large classes of records

Data held under sector-specific federal regimes for health, financial or credit reporting is commonly carved out, because it is already governed elsewhere.

Employment and business-to-business contact records have been treated differently over time, and information about other people entangled in your records is withheld to protect them.

The result is a file that can be simultaneously enormous and incomplete, in ways that are lawful and not obvious to the recipient.

Deletion is a separate right with its own limits

A deletion request does not clear everything, since businesses may retain what they need for transactions, security, legal obligations and internal uses consistent with expectations.

Requests must also be passed to service providers, which is why the response often describes instructions sent to other companies rather than confirming any outcome.

Backups are typically addressed by committing to delete on the next restore or rotation rather than by locating a record inside archived copies.

Response format decides how useful it is

Laws generally require a portable, machine-readable format, so the file should be something you can open and process rather than a printed summary.

Timelines are set in statute, usually a fixed number of days with a permitted extension, and a business that fails to answer has an enforcement problem rather than a discretionary choice.

Because both the rights and the exemptions vary by state and are amended regularly, what any particular resident can obtain depends on where they live at the time they ask.