JORDI PALET MARTINEZ writes:

Even worst ...

You've read that, but automated systems will not do, just use the abuse mailbox.

Anyway, I think in general the information will get if an automated abuse report is sent, will be not personal, but from an organization.

In fact, if they send personal data to the "abuser", I think they will be breaking the GDPR, because you need an explicit consent to transfer personal data to third parties, right?

And of course, in front of law, all this text is "wet paper". If there is a claim because an abuse case, and their customer doesn't respond, they may be liable.

Regards, Jordi @jordipalet

It can make sense. When there's an abusive resource that usually falls in one of these two cases: a) The customer was compromised by the bad guy b) The customer itself is the evil guy For case a) it absolutely makes sense to notify the customer. Moreso, the *should* notify them (independently of other measures they may take). If the isn't aware of the issue, they will hardly fix the vulnerabilities on their site. For case b) the customer SHALL NOT be notified. The provider itself must handle the complaint, not the evil guy. Now, every company has its own procedures. A few will directly delete the customer account, even in case a). Some will suspend the website and let the customer clean it themselves. Others will roll the site back to a previous backup, or otherwise delete the extraneous files themselves. Some companies pass along the complaints to the customer. Specially when the server is fully administered by the customer, as seems to be offered by this company ("dedizierte Root-Server"). Some companies will overview that the customer do handle such compliants in a satisfactory way. I'm afraid others won't. But I see no problem in that they forward _certain_ reports to the customer. Ideally, the company itself would have someone hadling the queue and classifying if the report is spam and must be discarded, if it should be passed to the customer to take actio (albeit not necessarily providing the details of the sender!), or investigated by the provider. Using an automated mechanism does result in faster processing, at the cost of lower quality. I appreciate that they openly reveal their policy. We reported some case explicitely stating not to send it to the customer, just to receive a "We have passed this to the customer" response. I sorely miss that they included a slow way to contact them in that banner (the hostmaster account, I guess?) for the case you don't want it forwarded but, if properly managed (which we don't know if they do), an automated system which automatically handles most reports could be acceptable. Not ideal, but still somewhat acceptable. Note we don't know if it's a dumb system that forwards everything, or if it's smart enough to identify the typology of most mails and decide based on a number of factors if it should be forwarded or not. Nor how this compares with the humans that would otherwise be handling such queue manually. Best regards -- INCIBE-CERT - Spanish National CSIRT https://www.incibe-cert.es/ PGP keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ==================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ==================================================================== In compliance with the General Data Protection Regulation of the EU (Regulation EU 2016/679, of 27 April 2016) we inform you that your personal and corporate data (as well as those included in attached documents); and e-mail address, may be included in our records for the purpose derived from legal, contractual or pre-contractual obligations or in order to respond to your queries. You may exercise your rights of access, correction, cancellation, portability, limitationof processing and opposition under the terms established by current legislation and free of charge by sending an e-mail to dpd@incibe.es. The Data Controller is S.M.E. Instituto Nacional de Ciberseguridad de España, M.P., S.A. More information is available on our website: https://www.incibe.es/proteccion-datos-personales and https://www.incibe.es/registro-actividad. ====================================================================

It sounds GDPR legal. After all, they are telling you exactly what will happen with anything that you send there, so by sending it there in full knowledge, you are essentially consenting to that processing of your data. Also, German courts have ruled that in-between service providers are only liable for taking action after the complainant has raised the issue with the party that is directly violating the rights of the complainant, or their hosting provider and those efforts have proven futile or can be objectively deemed to be futile from the outset. And finally, who says their customers are the abusers? In many cases, their customers may be the victims as well, without their knowledge, for example due to compromised CMS and would indeed be the best person to address the issue you may want to see resolved. -- Volker A. Greimann <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2> On Fri, Feb 19, 2021 at 10:07 PM Nick Hilliard <nick@foobar.org> wrote:

furio ercolessi wrote on 19/02/2021 20:55:

...

This is so absurd, I had to read it twice to make sure that I was not misreading it. They state that they automatically pass all my personal data to abusers if I send a report to them, so that:

it's difficult to see how this is fully compatible with the GDPR. Have you opened up a case with the Data Protection Office in Italy? Germany has strong data privacy laws, so there may be a legal way of handling this.

Nick

Volker Greimann wrote on 20/02/2021 00:39:

It sounds GDPR legal. After all, they are telling you exactly what will happen with anything that you send there, so by sending it there in full knowledge, you are essentially consenting to that processing of your data.

the best that could be said in this situation is that it's not clear. If you're reporting an abuse complaint to a responsible provider with clearly documented abuse processes which are carefully followed, and who has a good relationship with a responsible client who had clearly documented abuse processes which are carefully followed, then maybe this might ok. OTOH if it's a bulletproof hoster with poor processes / process compliance and the client abuses abuse reports (e.g. uses them to confirm that emails are still active), then that's less likely to be in any way legal. But a-priori, you don't know. Also GDPR consent compliance isn't achieved by "telling you exactly what will happen with anything that you send there". The European Data Protection Board has extensive documentation on GDPR interpretation:

https://edpb.europa.eu/our-work-tools/general-guidance/gdpr-guidelines-recom...

of which the document regarding Consent is well worth reading:

https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-05...

Specifically it notes: "As a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid". tl,dr: ianal + the OP's case would benefit from analysis by an actual lawyer with competence in this complex area. The above is purely speculation. Nick