[h0mEDw]

Nothing fancy, and I sent it to the contact point they have in their privacy policy. You can find it on their websites (or at least I found it; in my case it was just an email but it will possibly escalate to snail mail). As far as contents goes - here it is, translated into English:

I am a/an [OPERATOR] subscriber, identification data: (...)

I would like to get a complete list of personal data that [OPERATOR] stores about me:

  - The history of telephone calls, metadata (when and where [to which number] I called or when and who [what number] called me) as well as the data itself (the content of the calls themselves);
  - The history of text messages, as in the case of calls - metadata and the data itself;
  - History of data transfer (Internet), as above - metadata and the data exchanged itself;
  - Connection history - when my phone was connected to the [OPERATOR]'s network, when in [OPERATOR'S COUNTRY] or when via roaming;
  - Location history - where my phone was located, e.g. which base stations it was connected to or from which country it was connecting or any other information allowing to determine my location more accurately than "Planet Earth";
  - History of used devices - IMEI numbers as well as other data collected about my device / devices;
  - Any additional information collected about me.

If any of the above mentioned types of data is not stored by [OPERATOR] please let me know.

[lmkg]

I don't think it's your responsibility to play whack-a-mole and guess what types of data you think they might have. It's their responsibility to tell you.

The right to access your data is Article 15 of GDPR. Section 1 lays out what they have to provide you. Part (b) of that is "the categories of personal data concerned." I'm no lawyer, but I take that to mean that they have to provide you with the complete list of processing they do.

If I were making this request, I would scrap the entire bullet-point list you wrote and say that I'm invoking my Article 15 rights to be informed of the categories of personal data that [OPERATOR] processes about me.

Relevant law text: https://gdpr-info.eu/art-15-gdpr/

[h0mEDw]

See, one of the reasons why I'd prefer someone who speaks legalese to do this :)

Thanks, makes sense. I wanted to make it clear I'm not happy with a response "Yeah sir, you live here and here, and your device model is X. That's your personal information.". But I'll keep pressing them, as I seriously do not entertain the idea that someone may store all the data that can be inferred from my activity in a mobile network.