[Bosnia and Herzegovina] Subject Access Request refusal by data controller
Let me just start by saying that my country's data protection law is closely modeled after the GDPR (basically mirrored since we're trying to become a member state of the EU), meaning I have the legal right to request a copy of my personal information from data controllers like the specific company I'm making the request from, even if their company is not in my country.
A bit of context on the issue, I asked for the billing address used on two older orders because I remember there was an AVS mismatch at the time. It took me days to figure out with much trial and error, but I forgot what I did to make it work, all I remember is that the address didn't match my bank statement. My now ex bank couldn't help, so they referred me back to the company because the AVS is on their side, so I made a Subject Access Request for a copy of the billing address, provided the 4 last digits of the card, and my ID.
For about 20 days, they kept treating it as a normal billing issue and ignored the actual request. I kept repeating that I wasn't asking them to fix a payment, I just wanted a copy of the address they already have stored. Only after I mentioned the 30 day deadline and said I would escalate it to my data protection authority if it continued to be ignored until then did they finally address it... by saying they couldn’t give me the information.
When I asked for additional information on why they couldn't, they said it was for security reasons, which I told them was too vague and that the law requires them to cite a specific legal exemption... which they responded by repeated the same answer. I then asked a simpler question, which was just to confirm the last four digits of the card used on those two orders - I provided them the last 4 digits of both cards I owned at the time and only asked to verify whether it was one or the other, thinking 'they request this data when handling billing issues, surely they can just verify whether I remember something wrong, maybe I didn't even use this card to begin with?'
And as a response I got:
"Be advised that we cannot disclose your information to you. As the legit owner of your account, you should be the one who is responsible to remember all correct information.
Thank you for your understanding. "
At this point I asked them to confirm whether this is their company's final decision, and said they can close the ticket if it is, and once they did it would be escalated to my data protection authority as a formal complaint for them to review.
Extra details of note, I also messaged their company's privacy email - and it opened a ticket for the same support. I asked support whether I'm on the right channel and to refer me how to get in contact with their DPO if I was using the wrong channel but they ignored that request entirely. The team they did send this to was an 'engineering' team, and I've never had any confirnation on what team is handling the requests or any detailed information I asked.
So, since my country's laws are basically a mirroring of the GDPR, I want to know everyone opinion on how I handled this situation and how said company's support handled my request?
For reference, this is our data protection law: https://azlp.ba/propisi/default.aspx?id=4546
I reference articles 6, 14, and 17 since they are of key relevance.