Case study · 2011 · filed 24 September 2026

He asked Facebook for his data and got 1,222 pages

A law student in Vienna used his right of access in 2011. The file that came back held three years of his life on the site, including messages he had deleted.

In 2011 Max Schrems, a law student in Vienna, used his right under EU law to ask Facebook for everything it held on him. What came back was a CD of PDF files, 1,222 of them, covering about three years of his use of the site.

The file held things he had deleted. Among them were messages about a friend's health that he had removed from his account. Deleting them on the site had not deleted them from Facebook's servers.

He filed 22 complaints with Ireland's Data Protection Commissioner, where Facebook's European business is based, and a 23rd after the Snowden disclosures in 2013. Those complaints started a decade of cases that went as far as the EU's highest court.

What it shows

You can't know what a company holds on you until you ask. The file is often longer than you'd guess, and it can include what you believed you had removed.

For your own record

Ask each company you use what it holds, from the email address the account uses. Keep the date you asked and the date they answered. If the answer includes something you deleted, that's the next thing to ask about.

More case studies

Amazon He asked Amazon for his data and was sent a stranger's 1,700 recordings A German customer made an access request in 2018. The link Amazon sent him held 1,700 voice recordings from someone else's home.
Tinder She asked Tinder for her data and got 800 pages A journalist used her right of access in 2017. The file listed her likes, her photos, the men she was interested in, and when and where every conversation with a match happened.
Ashley Madison Ashley Madison charged people to be deleted, and kept the rest The affair site charged a fee for a full delete and kept deactivated accounts indefinitely. Then it was breached, and 36 million accounts were exposed.