[DanBC]

> by simply overwhelming them with valid requests under GDPR,

Doesn't work in the UK because the request has to be genuine and not vexatious.

https://2040infolawblog.com/2019/05/19/a-cure-for-blindness/

> The relevant text in the final version (Article 12.5) is as follows:

> Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

> (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

> (b) refuse to act on the request

[Dylan16807]

Also they have 30 days to respond, so at most you can force them to grab your data every 3-4 weeks even without that clause.