Last time I talked about GMail I mentioned that my account was blocked for sending about 100 e-mails despite following Google's best practices for doing so. On July 23 I got my access back, and I though I would update you all on how that happened since.

Note: This article is rather long because there's plenty of e-mail content. If you don't care about the details, you can jump to the end for a timeline and some final thoughts.

March

After getting my account blocked on March 27, I contacted Google support. Following an automated message receipt, I received this message:

Hello Google user,

Your account has been disabled due to unusual activity being detected. We take security seriously and want to make sure that only you have access to your account.

(...)

How do I regain access to my account?

Sign in to any Google product. If your password is accepted, you'll be asked a set of questions to verify that you are the owner of your account. Once the verification is complete, you can safely continue using your account.

What if my password doesn't work?

If your password is rejected, please visit the [Account support page] and answer all of the prompted questions as best as you can.

If you remember my previous post you might know that none of these suggestions is useful. I replied with a message saying exactly that, but I got no response.

April

Here's an interesting fact: while Google has no obligation to keep me as a customer (or, in this case, product), they are obligated by the General Data Protection Regulation (GDPR) to give me a copy of my personal data. And even though Google provides a tool for downloading a copy of your data, the tool is useless if you can't log in. With this in mind, and with the help of the My Data Done Right tool, I sent the following letter (yes, letter) to Google's Data Controller on April 28:

To Whom it may concern:

I am invoking my right to data portability as specified in Article 20 of the General Data Protection Regulation. In particular, I am requesting Google Ireland Limited ("Google") to either provide me with a copy of my e-mails and other personal data in a structured, commonly used and machine-readable format or to grant me access to existing tools such as Google Takeout so I can do it myself.

I am the owner of the GMail email address <redacted>@gmail.com. For the past two weeks Google has blocked my access to my account and refused all methods of verification. I have provided the correct password, the correct verification e-mail address and a valid telephone number, none of which worked. Both the "Google Takeout" tool and the "Data Access Request Form" mentioned here are unavailable to me for this reason.

I request that Google either restores my access so I can use Google's tools myself or that Google provides me with a copy of my data following the GDPR's Right to Data Portability. I can provide further means of verifying my identity if necessary.

Why a letter? Three reasons:

• Because I knew a human would have to process it.
• Because I wanted a paper trail in case I decided to hire a lawyer (I paid extra to send it via registered mail).
• Because signing as "Dr. Martín Villalba" with blue pen sends the signal that I'm an annoying person and that we would all be better off if they simply fast-tracked my request.

May

On May 4 I got the following reply from Google's Data Protection Office:

Hello,

Thank you for contacting us.

It sounds like you're having some problems with your account.

• If you can't sign in to your account: Learn how to [recover your account]
• If you're having trouble recovering your account: Try these tips to get [your account back].

Regards,

Google

After following the steps above (once again, they didn't work), I made a mistake. See:

• What I should have replied is "this is not an account recovery request, but rather a data access request. While giving me my account back is one way of fulfilling that request, that's not the purpose of my letter".
• What I did end up replying was telling them that I tried all of those options and none of them work.

Why was that a mistake? Because this is the reply I got on the same day:

Hello,

Thank you for contacting us.

Please note that this team does not handle account recovery related questions. Please refer to our prior email for more information, as well as follow these steps to recover your account [g.co].

As we are not able to further assist you, we are closing this inquiry.

True to their word, they closed the inquiry and never replied again.

June

Having learned from my mistakes, on June 1st I sent a second letter to politely remind them that it's been more than 30 days since my request. Why? Because 30 days is the period granted by the GDPR to fulfill data access requests like mine.

To Whom it may concern,

I am the owner of the Gmail address <redacted>@gmail.com. I have contacted you on April 28th to request a copy of my personal data as it is my right under Article 20 of the General Data Protection Regulation. It has been more than 30 days since my original request (Internal Ref. <redacted>) and yet I have received neither a copy of said data nor access to a tool where I could download it myself.

I request once again that you provide a copy of all my data (including the content of my e-mails) in a structured, commonly used, and machine-readable format. As a reminder, I have no access to the "Google Takeout" tool and none of the options suggested in the following links grant me access to the data I request. Therefore, I cannot accept suggestions of using these websites as a valid response:

• https://g.co/recover
• https://support.google.com/accounts/answer/7682439
• https://support.google.com/accounts/answer/7299973

To reiterate: this is not an account recovery request - it has been more than two months since Google revoked access to my account and I consider it deactivated for all practical purposes. Instead, I only request a copy of my personal data. For purposes of identification I am still in possession of the current password and the recovery e-mail address, but I would be willing to provide further proof of identity if necessary.

And then I went back to living my Google-free life.

July

On July 16th I opened my e-mail and found this:

Hello,

Thank you for contacting us.

The information you seek may already be available to you via a number of secure online tools we provide to all users to access data. Sign in to your [Google Account] to get an overview of the ways you use Google’s services and access that data. Here are some other actions you can take:

(... long e-mail redacted ...)

To which I replied

Dear Sir or Madam,

thanks for your reply. As I explained before, Google has blocked access to my account. None of those tools work for me because I cannot sign in and no one replies to my account support emails.

Seeing as your office is in charge of data requests, I reiterate my request that my data be provided to me. Suggesting apps I cannot use are not a satisfactory response to my request.

On July 22nd, and coinciding with the anniversary of the most expensive hyphen in history, I finally got a step closer to my goal.

Hello,

We understand that you can’t sign in to <redacted>@gmail.com. You can file a claim and start the process to get back into your account.

To recover your account:

File a claim with the [Google Internal Escalations link]. This is a special link, so please do not share it with anyone.

Important: This link creates a claim so the Google Accounts team can investigate, but doesn't guarantee you'll get your account back. However, please make sure we have the relevant information to investigate.

Here's what I told the Accounts team:

Hello,

my case ID is <redacted>. As a reminder, this is a request for a copy of my personal data - while access to my Google account does fulfill this request, I am just looking for a copy of said data in any electronic format.

And guess what? On July 23 I finally got what I was asking for:

Hello,

To recover access to <redacted>@gmail.com, reset your password.

          [RESET PASSWORD]

The link to reset your Google account password expires in 7 days. If your link already expired, reply to this email to get a new link.

Timeline

• March 27: my account is blocked. I fill an online form, but I only get a canned response.
• April 28: I sent my first letter.
• May 4: I receive an e-mail misunderstanding the problem. My ticket is closed.
• June 1: I sent the second letter.
• July 16: I receive an email suggesting I use Google Takeout. I reply that this doesn't help because I can't log in.
• July 22: I receive a link to escalate my issue.
• July 23: I regain control of my account.

Final thoughts

I'd like to once again thank the My Data Done Right people for providing letter templates that I could use and, more important, the mailing address of Google's Data Protection Office. If you are in the EU and you have data access problems, make sure you pay them a visit.

If you don't have as much time as I do, then a lawyer might help you speed up the process. I imagine a certified demand letter from a lawyer might have gotten me a quicker resolution, but now we will never know. Feel free to get your account banned and let me know afterwards how it goes.

And finally: take control of your data. Make sure that what happened to me can't happen to you. You don't have to administer your own e-mail, but you can definitely use a provider with reasonable customer support.