An unintended consequence of the EU General Data Protection Regulation (GDPR) are fake, or nefarious requests for access to or deletion of information.

Some points to note:

• If you received a (badly worded) request for erasure under GDPR, where you have confirmed that GDPR does not apply or where you cannot authenticate the individual properly, consider whether this request could double as an unsubscribe request under CAN SPAM, with which you must comply.
• Once you have collected all the data to give to the data subject and before disclosing it to the individual, have the materials reviewed by counsel to determine:
  • do all the documents you collected really constitute “personal data” under GDPR
  • can this be disclosed without breaching other rights — those of the company, or those of other individuals
  • does any other exception under GDPR apply to the obligation to produce or delete the information.

Details from the International Association of Privacy Professionals.