How to request all your curator data (EU and UK residents)

Here is the template we have prepared for you to exercise your rights as an EU and UK citizen and reclaim your curator data from platforms according to the GDPR (General Data Protection Regulation). 

GDPR is legally binding for companies worldwide, as long as they collect or process data from EU residents. Note that, even though the UK is no longer part of the European Union, it has maintained a mirrored version of the data protection laws.

Once you submit this request, platforms have a legal deadline of one month to respond and deliver your information. And more importantly, workers are legally protected against any retaliation or negative repercussions for submitting these requests, and European courts strictly reinforce these protections with severe sentences including millionaire fines on platforms who failed to comply. 

If you are an EU citizen, copy the text below, fill your information at the bottom under "Identification Information" so the platform can identify your profile and send it as an email to the platform.

Once you receive their response, please forward it to info@unitedcurators.org . We will help you interpret the data and identify key parameters. We will not share your data with any other members or any third parties, but by pooling all the responses we collect, we will be able to learn how these platforms and their algorithms actually work and prepare reference documents for the community, putting us in a much stronger position to defend our individual and collective interests as curators.

--------------------------------------------------------------------------------------------------------------------------------------------------------------

Hello dear data controller,

With this letter, I am sending you my request.

This is a request for transparency under the General Data Protection Regulation, including a

request for access, a request for portability and other specific provisions. 

**Please note that it is not lawful to ask data subjects to use an internal form.**

See for example UK Information Commissioner's Office, 'Subject Access Code of Practice' (June 9, 2017) p. 13; and Information Commissioner's Office, ‘Guide to the GDPR: Right to access’ (May 22, 2019), stating that “even if you have a form, you should note that a request for access is valid if submitted by any means, so you should always comply with requests you receive in a letter, standard email or verbally [...] although you may invite individuals to use a form, you should make it clear that this is not compulsory”).

I request a copy of all my personal data held and/or being processed as a curator on the platform. 

'''Copies of my personal data'''

This request concerns all my personal data. 

Article 20

---------

For data falling under the right to data portability (GDPR Article 20), which includes all data I have provided and all that has been indirectly observed about me (Article 29 Working Party, Guidelines on the Right to Data Portability (WP 242)*, December 13, 2016, 8) and where the legal bases for processing include consent or contract.

I would like this data:

- **To be sent to me in a commonly used, structured and machine-readable format** such as a CSV file. 

Note that a PDF is not a machine-readable format (Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ WP260 rev.01, April 11, 2018).

- Accompanied by **an intelligible description of all variables.**

Article 15

----------

For all personal data not covered by portability, I wish to request under the right of access

(RGPD, art 15):

- **a copy to be sent to me in electronic format**. This includes all data derived about me, such as opinions, inferences, settings and preferences. (Note that opinions, inferences and the like are considered personal data. See Case C-434/16 *Peter Nowak v Data Protection Commissioner* [2017] ECLI:EU:C:2017:994, 34). 

For data for which the data controller has and which is in a machine-readable format, it must be provided to me in that form in accordance with the principles of fairness and data protection by design.

As is well known, the concept of personal data must be interpreted as broadly as possible, in accordance with, among others, the opinions of the Article 29 Working Party, the EDPB guidelines, and the case law of the Court of Justice of the European Union.

Consequently, my request for access, copies, and additional information encompasses the concept of:  

• Personal data in its broadest sense, including, but not limited to, notes, comments, feedback provided, assessments, and all data relating to my person, profile or my personal data. This includes, inter alia, observed data or raw data provided by me through the use of the service (such as data processed by connected objects, transaction history, activity logs—including access logs and website usage history—searches, location data, and data derived or inferred therefrom; clicks; and unique behavioral traits such as keystrokes patterns or navigation paths; voice and audio data, including any voice recordings raw audio files, associated metadata, and any transcriptions retained on your servers). 

• Data derived from other data that I have not directly provided (including, but not limited to, submission history, ratings, reviews, classifications based on common attributes, etc.).

• Data inferred from other data that I have not directly provided (including, but not limited to, credit scoring, AML compliance results, algorithmic outputs and data derived or inferred from them, health assessments, or results from personalization and recommendation processes), pseudonymized data (as opposed to anonymized data), metadata, etc.

If your organization considers me to be the data controller for which you process data

----------

In addition, if your company considers me to be the person responsible for processing the personal data for which your company acts as a processor, please provide me with **all the data you process on my behalf in a machine-readable format** in accordance with your obligation to respect my determination of the means and purposes of processing.

Furthermore, I request the following categories of information: 

1 - Automated individual decision-making, including profiling 

• Please confirm whether or not you make automated decisions (within the meaning of Article 22 of the GDPR). 

If the answer is yes, please provide meaningful information about the logic involved, as well as the significance and envisaged consequences of this processing for me in accordance with Article 15(1)(h)) of the GDPR.

2 - Processing metadata

This request also includes the metadata to which I am entitled under the RGPD.

Information on data controllers, subcontractors, sources and transfers:

- The identity of all persons jointly responsible for processing my personal data, as well as the content of your contractual relationship with them (Article 26).

- All **third parties to whom the data has been communicated**, with names and contacts in accordance with Article 15(1)(c) of the GDPR. Please note that the European data protection authorities have considered that, by default, data controllers must name recipients specifically and not “categories” of recipients. If they choose to name only categories, they must explain why this is specifically justified, indicating “the type of recipient (i.e. by reference to the activities he/she carries out), the industry, sector and sub-sector and the location of the recipients”. (Article 29 Working Party, 'Guidelines on Transparency under Regulation 2016/679' WP260 rev.01, April 11, 2018 ) Please note that in the case of any transfer of data processed on the basis of consent, it is not possible to simply name the categories of recipients without invalidating this legal basis (Article 29 Working Party, 'Guidelines on Consent under Regulation 2016/679' (WP259 rev.01, April 10, 2018) 13).

- If data has not been collected, observed or inferred directly from me, please provide precise information on the source of such data, including the name and contact email of the data controller(s) in question (“from which source the personal data originates”, Article 14(2)(f) and Article 15(1)(g) of the GDPR).

- Please confirm where my personal data is physically stored (including backups) and, at a minimum, **if it has left the EU at any time (if so, please also detail the legal bases and safeguards for such data transfers)**.

3 - Information on purposes and legal basis

- All **the purposes of processing and the legal basis for these purposes by category of personal data**. This list must be detailed by purpose, by legal basis corresponding to these purposes, and by categories of data concerned by these purposes and bases. Note that it is not acceptable to simply provide separate lists that do not provide the correspondences between these three factors (Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ (WP260 rev.01, 11 April 2018), p. 35). The best way to display this information might be in tabular form. 

- and specific legitimate interest where legitimate interest is invoked (Article 14(2)(b)).

4 - Information on data retention

----------

- Please confirm the retention period for each category of personal data, or the criteria used to make this decision, in accordance with the retention limitation principle and in compliance with Article 15(1)(d) of the GDPR.

If you do not usually handle such requests, please forward this e-mail to your Data Protection Officer. 

If you need advice on how to handle this request, any European data protection authority

should be able to help.

In accordance with the law, I expect your reply within one month of receipt of this request.

Procedure: 

To ensure an orderly procedure regarding the correspondence of this case, I kindly request that you:

• Confirm receipt of this request via email, clearly outlining the processing stages and expected completion dates.
• Inform me via email once the request has been fulfilled.

Identification Information:

Full Name :   _______________________

Profile Name: _______________________  

Profile Link:   _______________________

Email address: ______________________

Country: ___________________________

Should you fail to comply with this request within the statutory period, or if the response is incomplete, I reserve the right to lodge a complaint with the relevant Supervisory Authority and to seek any judicial remedies available under Article 79 of the GDPR.

I look forward to receiving your response within the established timeframe.

Sincerely,