The ‘lack of clarification’ nuance.
Another example relates to those seemingly random telemarketing messages you may be getting. Although under GDPR you can only use a customer’s contact details to market ‘similar products and services’ to them that they initially agreed to, there’s no definition of what this phrase means. So it can be up for debate.
The law also says that you have to provide an identity for the person responsible for this telemarketing communication, but there’s no law against ‘disguised or concealed identities’ i.e. a fake identity.
Another lack of clarification is that GDPR and the E-Privacy Regulation says that you should verify the identity of the person making a SAR, but it doesn’t specify how. An experiment found that after an individual made a SAR request on behalf of his wife, ‘approximately one in four firms shared his partner’s personal information without consent’.