SAR / GDPR Request and Imminent Litigation vs PayPal and Cameron McLean, Racist Transaction Flagging

[Tholok]

Hey guys,

I am a longstanding PayPal customer. I am also legally qualified here in the UK, although I do not practice as a solicitor. I made a Subject Access Request (SAR) under the General Data Protection Regulation (GDPR) on 05 November 2020 to <Removed>. I also complained that I was concerned that PayPal was flagging transactions with Middle Eastern / Muslim names, which is racist. I had paid for a thing, which had the name, '<Removed>' in the transaction details. On searching this community and elsewhere I noticed many people complaining that transactions which normally worked were flagged if they had non-Caucasian names. I was asked to put it in the Message Center, but could not reply to the ticket so I emailed <removed> again on 9 December 2020. This time no response was received.

Earlier this month, having given PayPal plenty of time, I raised the SAR again in a fresh Message Center ticket. I was asked to await a security call to be at some unspecified time within 3 days. This is, itself, especially unhelpful. However, I took the call and completed security checks. Whereupon the customer service agent asked me to make a further written request with a passport and handwritten letter. When I challenged him, he changed his position and said it could be signed not completely handwritten.

I uploaded the letter. On 19 February 2021 I received a purported final response dismissing the complaint without much in the way of reasoning or explanation, and not even acknowledging the existence of the SAR, presumably refused. I propose to take court proceedings to compel, and this may include, as well as GDPR proceedings, a claim under the Equality Act 2010. So far, I have been hoping assertive correspondence will do the trick. However, as PayPal is apparently ignoring me I will have to start drafting a Form N1.

PayPal appears to operate a group of companies, including PayPal Europe and Paypal (UK) Limited. PayPal UK can be validly served by serving its directors such as <Removed>, similarly PayPal Europe is registered in the UK and can be served, e.g. by serving the Company Secretary. I am concerned though that emailing the CEO of PayPal UK about a minor administrative matter has not yielded a swift resolution. This, combined with the disproportionate demands in terms of the SAR, may lead to suspicion that PayPal is in fact hostile to SARs in general and does not wish to disclose matters in relation to the equalities complaint.

I note that others here have experienced similar issues with SAR's being ignored - GDPR - PayPal Community (paypal-community.com). These messages are being archived for the purpose of evidencing systemic incompliance and trying to arrange a fine for PayPal via the Information Commissioner.

So far my letters and emails have been general and short, in the absence of a response, I will have to engage in the tedious task of particularising a claim to compel disclosure, identifying the legal entities which are Data Controllers, and sending process servers to serve directors at their homes.

Or they could, y'know, respond to the SAR and substantially on the discrimination issue.

Can anyone else who has had a similar problem reply so I can use it as evidence please?