A couple of things.
All of this discussion is being conducted in more or less a vacuum and this speaks to the other part of my complaint about Plex’s behavior: in no way are they in compliance with GDPR. If they were, there would have to be some kind of transparency about how they arrived at this decision and, importantly, the right of the data subjects affected by it to dispute it. Neither you nor I have any idea what the legal basis under GDPR is for this action and, one suspects, they don’t know themselves because they haven’t thought about it. Under Article 5, data processing as occurred here has to be lawful, fair, and transparent. There is no indication that this action is any of those things and, as an EU citizen, I’m entitled to know the legal basis. According to Recital 71, such processing should be:
subject to suitable safeguards, which should include specific information to the data subject and the right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision.
None of that is in place here.
Because of this complete lack of transparency, what is pure conjecture in both our arguments is whether Plex relied “solely” or only partially on automation in making the determination. You don’t know that it wasn’t 100% algorithmically determined and I don’t know that it was. A data protection policy in keeping with GDPR would clear that up. But bear in mind that just because humans are involved, doesn’t mean the process isn’t “solely automated.” And bear in mind, as WP29 makes clear: superficial human involvement doesn’t mean the process isn’t solely automated.
Finally, you keep using “personal data” in a way not consistent with the GDPR definition in order to claim I’m not being profiled. I’ve explained why that’s not correct: an IP is personal data and the fact that they knew who to email about my IP is proof. Here’s the definition from Article 4:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
[emphasis mine]
And if you look at Plex’s privacy policy they list “IP address” explicitly under “personal data.”
I fully intend to contact the Data Protection Commissioner. In my experience, they take all such reports extremely seriously and, whether Article 22 in the end is applicable or not, I don’t think there’s any doubt that Plex’s public-facing documents are in no way compliant with GDPR, which is both what makes their recent decision an abuse and enables that abuse to take place.
It’s clearly a matter of discrimination in the context of Plex’s decision.
