The request for my data from Turku regional transportation had to be done in person, which is kinda-fine, but it should have been possible online though Suomi.fi messages or on Föli’s site, but nope it is not.
The form I was given when asked to file a information request (per General Data Protection Regulation) was nothing fancy, it just asked to type your name, address, phone number and travel card number (altrinatively social security number too). I filled out all of the information as I have been using their mobile app which allows for loan top-up of the travel card among other things. The request was filled on 13st of November.
I have received an email from them day before their 30 day(s) processing time has passed to let me know that they won’t be able to meet the time frame required by law to give give me the requested information.
They only said that they are waiting on their I.T department to get them a way to transmit the data securily and confidentialy. I replied to it to ask if they knew about GPG, but they ignored the question and replied with really nothing relevant to my question.
I have now asked them to provide me the person’s contact information who’s responsible for this process as it’s really bad. Will need to see how it goes. I’ll update this blog post when I know more.
I have recieved a reply from them, though a web portal which is not really confidential email, at least in it’s normal context and the data provided does not include all the requested information as I thought they would ask the travel card number so they can get me the data saved on it, but apperently that’s not the case. They instead just basically listed the same information they asked me in the form I was given to request it in the first place.
They did not verify my identity with any proper strong authenication, prior to letting me access my data. They only used a PIN that’s sent to your phone number. That’s definitely not a authenication method in this context and much less so strong one, that code can be intecepted at any point in transit as it’s sent in cleartext.
I have now sent a question about this to their director of development, saying about the problems in the process aswell asking for my travel card saved data. I would hate to have to ask from Data Protection Ombudsman help with this (Source: https://tietosuoja.fi/en/when-you-want-to-inspect-your-data).