topic Re: Anyone else seeing "Data Removal Request" mailshots? in Privacy

Anyone else seeing "Data Removal Request" mailshots?

Del — Tue, 05 Jun 2018 10:46:20 GMT

Hi there ... I'm looking for your thoughts & wisdom on this.

In the last two weeks, I've seen a bunch of emails with the same Subject and Body Text .. only the email addresses change.

The Subject is always "Data Removal Request"

The Body Text is always

"I hereby withdraw my consent for you to collect, process or store any personal data related to name@emailprovider.com

I request that you delete any and all data related to, and belonging to name@emailprovider.com that your company stores, pursuant to my rights under Article 17 GDPR.

Thank you!"

These requests have covered emails from a variety of free email providers, gmail.com, gmail.fr, hotmail.com ... which makes me think there is a system or service out there generating these emails on behalf of individuals ... possibly for a nominal fee 🙂

Of the 20 or so emails we've seen, only a handful of the emails are actually customers / users of our service ... which makes me think the system or service sending these emails is generating mailshots and firing them out to a range of service providers like my company

Anyone else seen this?

I'm going to work through the email headers to see if there are any clues ... but I thought it was worth posting here in case anyone else is in the same position as me 🙂

Re: Anyone else seeing "Data Removal Request" mailshots?

Del — Tue, 05 Jun 2018 14:36:29 GMT

Going through the email headers ... I see some of them reference "gmailapi.google.com" ... which supports the idea of an app or service.

The ones that don't mention the gmailapi, do have a mapi id

Hmmmm

Re: Anyone else seeing "Data Removal Request" mailshots?

Baechle — Tue, 05 Jun 2018 19:40:43 GMT

Del,

Have you figured out the origin from the headers? Care to post the envelope info so we can look?

@Del wrote:
Going through the email headers ... I see some of them reference "gmailapi.google.com" ... which supports the idea of an app or service.

The ones that don't mention the gmailapi, do have a mapi id

Hmmmm

Re: Anyone else seeing "Data Removal Request" mailshots?

Baechle — Tue, 05 Jun 2018 19:51:55 GMT

Del,

It appears as though your organization is within its rights to charge a fee before complying with/responding to unfounded requests.

This can be found in the "Can we refuse to comply with a request for other reasons" section of the ICO guidelines on erasure found here:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/

Re: Anyone else seeing "Data Removal Request" mailshots?

Del — Wed, 06 Jun 2018 10:52:21 GMT

Seems to be more than one origin ... one for gmail.com and gmail.fr users, and another for outlook.fr and hotmail.com

The first "Received" header for the outlook users:

Received: from AM4PR10MB0241.EURPRD10.PROD.OUTLOOK.COM
([fe80::2d19:ac0c:2541:ba71]) by AM4PR10MB0241.EURPRD10.PROD.OUTLOOK.COM
([fe80::2d19:ac0c:2541:ba71%6]) with mapi id 15.20.0820.012; Fri, 1 Jun 2018
19:09:27 +0000

Searching for that mapi id (15.20.0820.012) returns some hits relating to possible email scams / malware

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_outlook-mso_win10-mso_2016/the-format-of-the-email-address-isnt-correct/6f6beaa5-ebd5-4290-9a11-172c36095f69

https://www.signal-arnaques.com/en/scam/view/115100

https://scamsurvivors.com/forum/viewtopic.php?f=6&t=67875&mobile=on

https://anti-scam.de/cgi-bin/yabb2/YaBB.pl?num=1525015818 (you need to click on the spoiler to see the mapi id)

The first "Received" header for the gmail users:

Received: from 426803448907 named unknown by gmailapi.google.com with
HTTPREST; Sat, 2 Jun 2018 14:18:09 -0400
MIME-Version: 1.0

For completeness ... this is what the email body text looks like, for both gmail & outlook users

I hereby withdraw my consent for you to collect, process or store any personal data related to <email address here>

I request that you delete any and all data related to, and belonging to <email address here> that your company stores, pursuant to my rights under Article 17 GDPR.

Thank you!

Re: Anyone else seeing "Data Removal Request" mailshots?

Lamont29 — Wed, 06 Jun 2018 20:17:46 GMT

@Baechle

That's really good information about the fee that a company can charge. I wonder if any government organization might capitalize on that option in order to mitigate the a litany of requests...

@Baechle wrote:
Del,

It appears as though your organization is within its rights to charge a fee before complying with/responding to unfounded requests.

This can be found in the "Can we refuse to comply with a request for other reasons" section of the ICO guidelines on erasure found here:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/

EB

Re: Anyone else seeing "Data Removal Request" mailshots?

someone — Thu, 07 Jun 2018 12:48:16 GMT

One such request each day since June 1, with seemingly random gmail addresses.

Re: Anyone else seeing "Data Removal Request" mailshots?

Del — Thu, 07 Jun 2018 14:06:48 GMT

Cool ... are they following a pattern? Similar / Same body text?

Can you post a sample?

Del

@someone wrote:
One such request each day since June 1, with seemingly random gmail addresses.

Re: Anyone else seeing "Data Removal Request" mailshots?

someone — Thu, 07 Jun 2018 14:57:47 GMT

Same plain text, all gmail addresses, no attachments, spf/dkim/dmarc ok (comes from google), addresses kind of resemble names, but not exactly, there are some errors/misspellings.

I hereby withdraw my consent for you to collect, process or store any

personal data related to xxxxx@gmail.com

I request that you delete any and all data related to, and belonging

to xxxxx@gmail.com that your company stores, pursuant to my rights under Article 17 GDPR.

Thank you!

Re: Anyone else seeing "Data Removal Request" mailshots?

Del — Thu, 07 Jun 2018 15:55:54 GMT

Thanks! It's got to be the same / similar thing.

For your gmail hits, do you see a 12 digit numeric associated with gmailapi.google.com in the headers?

Reading from the bottom up, at the first "Received:"

Received: from 426803448*** named unknown by gmailapi.google.com with HTTPREST;

I'm kinda relieved it's not just me seeing this 🙂

Re: Anyone else seeing "Data Removal Request" mailshots?

Baechle — Thu, 07 Jun 2018 19:08:06 GMT

Del,

This may be an awkward form of Denial Of Service attack. Trying to get services to delete accounts for people who withdraw their authorization?

Sincerely,

Eric B.

Re: Anyone else seeing "Data Removal Request" mailshots?

craiglurey — Fri, 08 Jun 2018 01:23:15 GMT

The emails appear legit, the users are replying with positive confirmation of account deletion. I have not found out which product or service is generating these emails yet.

Re: Anyone else seeing "Data Removal Request" mailshots?

craiglurey — Fri, 08 Jun 2018 01:32:30 GMT

I found the service that is generating these emails:

https://www.deseat.me/

Re: Anyone else seeing "Data Removal Request" mailshots?

someone — Fri, 08 Jun 2018 09:52:40 GMT

It is the same one, for all messages, and none of them are actual users of our services. I received also legitimate requests, but with different wording.

Re: Anyone else seeing "Data Removal Request" mailshots?

Del — Fri, 08 Jun 2018 11:00:47 GMT

@craiglurey

Excellent!

How did you find it? I was searching for ages, didn't get close to it.

Re: Anyone else seeing "Data Removal Request" mailshots?

Del — Fri, 08 Jun 2018 15:47:13 GMT

I went through the motions of using this deseat.me service.

All I have to do is give this third party my login credentials for gmail ... what could possibly go wrong 😉

Don't get me wrong, I think it's a pretty good idea, and I do like the way it finds likely candidates in your email history ... but think about a service that "protects your privacy" ... so long as you give it your credentials first.

It also promotes another service, Ctrlpanel, which will manage strong & unique passwords, for sites & apps that you want to keep using.

Re: Anyone else seeing "Data Removal Request" mailshots?

MarkoTanaskovic — Fri, 08 Jun 2018 15:57:13 GMT

On the password, well they claim to be using Oauth (haven't tested yet, this is from their documentation),so they would not see the password itself.

We would authenticate and authorize against our mail provider, to allow this service access to the mailbox, which they then scan to sift out which services we might be using, and send the notifications. Also the question what would we exactly authorize (at least view full data, and act on our behalf ? ), and what happens with the permissions afterwards. Does the service de-authorize itself, once done, or do we need to do this ?

Apart from authorizing access, this scanning part could yield other data about us, to that service.

On a similar topic, this is automation on a scale, and I wonder how equipped ( on the process automation side ) are the companies to deal with potential amount of data. This could be a sort of "DDoS" on backend processes.

Re: Anyone else seeing "Data Removal Request" mailshots?

Del — Fri, 08 Jun 2018 16:16:43 GMT

I tried it earlier today, after granting the service access to my gmail account, it found about 25 services / sites / apps ... and invited me to accept, delete (add to queue for delete) or mark invalid.

The google account permissions persisted after the service had run ... but I did have the option to remove the access from the "Apps with access to your account" pane on myaccount.google.com/permissions

Re: Anyone else seeing "Data Removal Request" mailshots?

MarkoTanaskovic — Fri, 08 Jun 2018 16:25:48 GMT

Thank you for confirming.

The questions that arise in my mind are the following :

1. How many average users are aware of this (we do not count) - that permissions remain, and you need to remove them manually ?

2. Depending on the acceptable usage policy, quite a lot of people use corporate email also for private purposes. If such a email service is cloud hosted, someone might permit access (to a 3rd party), to corporate data.

To the second point, think of all the apps that have the "Sign in with..." option, this is basically the same...

Re: Anyone else seeing "Data Removal Request" mailshots?

someone — Sat, 09 Jun 2018 08:24:58 GMT

The number of requests started to increase yesterday, still none of them valid. I wonder whether I can ignore these, as there is no data for these customers kept in the database.