Ross O’Carroll-Kelly (pictured left) is in GDPR-trouble again. Last time, he was fired from his job as an estate-agent for failing to report a data breach, when his work lap-top was stolen from his car just as the GDPR came into full effect. This time (as recounted in last Saturday’s Irish Times magazine; audio here), he learns to his great cost the power of the data subject access request under Article 15 GDPR.

The background is well explained by Jennifer O’Connell’s experiences also recounted in last Saturday’s Irish Times magazine. Her story starts with staff members in a hotel asking customers: “If you enjoyed the service, would you minding leaving a TripAdvisor review, and mentioning me by name?” As she explains

It’s not only people in the service industry whose job security now rests on the whims of the terminally irate. If you’re a writer, Goodreads and Amazon reviews are your nemesis. If you’re a driver, it’s Uber. If you rent out your house, it’s Airbnb. If you’re a journalist, it’s the below-the-line comments.

She hasn’t reviewed the hotel waiter yet (she’ll be kind); but “in a Dublin hotel a few months ago, unable to sleep due to the sound of the four-hour, vigorous, live-action porn show on the other side of the cardboard door connecting [her] room with the one next door, [she] lay there plotting [her] TripAdvisor review”.

However, on some of these platforms, reviews go both ways. For example, not only do riders rate drivers on Uber, but, after every trip, drivers can rate riders as well. It is the same with the taxi app being used by Ross’s wife, Sorcha. She’s worried because she has an average “one-stor” customer rating from the drivers, out of five, which the lowest rating that it’s possible to get. This gets Ross worried too, not because he’s concerned for his wife, but

because her one-stor rating is almost certainly down to me, given that I’ve been using her account for the past six months and taxi drivers tend to bring out the worst side of my personality.

He tries to make light of it, but Sorcha is having none of it, revealing that she has already

… made a Data Access Subject Request. … All citizens have the right to access their personal data, Ross. I’m entitled to know why taxi drivers seem to think so little of me, especially given how much I tip.

As Sorcha leaves Ross to check whether the postman had delivered the hardcopy reply, their daughter-from-hell, Honor, arrives, having intercepted the post along the way. Together, they read all the horrible things Ross said to the taxi drivers over the previous six months; and they learn of some co-passengers Sorcha might not like to learn about; so Ross bribes Honor a thousand euros not to say anything to her mother. She agrees. And Ross relaxes, thinking he’s off scot-free. Then:

Sorcha steps back into the kitchen. “Nothing in the post,” she goes.

I’m there, “Like I said, you should just let it go, Babes.”

“No, it’s fine,” she goes, holding up her phone, “because they’ve emailed me the information anyway.”

Honor stands up from the table. She goes, “I’ll leave you to it, Dad. I still want that thousand euros, by the way.”

I wonder if anyone’s left a comment on Jennifer’s TripAdvisor review of the performance in the adjacent hotel room, or perhaps lodged a subject access request to find out more about it?