8 ms·

> I was able to ask my PhD college, and several other institutions, to see all emails in which my name appeared in either the subject line or the body of the em

> I was able to ask my PhD college, and several other institutions, to see all emails in which my name appeared in either the subject line or the body of the email Hmm, I don't think I like this, and I don't understand how the GDPR allows you to do this. While I understand that stored emails that mention you are technically "data about you", I wouldn't consider them "your data". Emails are a form of personal communication, and are only really accessible by the author and recipients. Furthermore, those emails would contain PI about other individuals - what of their rights, or indeed the rights of the email authors (regardless of the message content)? I support the GDPR, but I don't think using it like this falls within it's intent.

bryanrasmussen 7y ago
yeah I would argue that was a data breach.
awakeasleep 7y ago
Interesting. In the USA emails are considered property of the employer. Outside of that, what is your take on the fact that there must be administrators that have the ability to look through all a system's email?
icebraining 7y ago
The GDPR does say "the right to obtain a copy (...) shall not adversely affect the rights and freedoms of others", but it doesn't spell out what that means. Still, your work email account can be monitored by your employer (though in the EU they have to provide notice of that monitoring), so you don't have the same protection as in a private account. OTOH, it could be a violation of privacy / data-protection for the author of this piece to be divulging the contents of these emails, even if they have a right to a copy.
- GordonS 7y ago
  > rights and freedoms of others", but it doesn't spell out what that means Hmm, that's unfortunate it's not at least a little more specific, but at the least I'd expect the right to lawful freedom of speech. I get that these are "work emails", but this just feels very wrong to me, and doesn't seem to fit with the intent of the GDPR.
  - pjc50 7y ago
    How does this infringe on freedom of speech? You can still make the speech, but it may get back to the person you're speaking about. Which, in an employment context, is kind of necessary for procedural fairness.
    - GordonS 7y ago
      I disagree; it should be possible to have private conversations regarding work, while at work.
      - brokenmachine 7y ago
        If you don't use your work email address for such private emails then that's fine.
- zaarn 7y ago
  >though in the EU they have to provide notice of that monitoring There is an interesting exception; if private usage of your work mail account is banned, it should not contain private data and therefore, it's free to be monitored. Same for internet usage. This is usually coded into your contract when you sign.
  - GordonS 7y ago
    Work emails can easily contain private data too. I might send an email to my manager asking for time off for deeply personal reasons, or informing them about very personal circumstances (e.g. health). There are of course numerous less impactful examples. An employer monitoring Internet usage is a very different case - in almost all cases it will be fully automated, and the logs only available to HR on request; not just any employee can request your logs.
    - brokenmachine 7y ago
      But those would only be discussing yourself. Nobody else would be able to request those emails.
    - zaarn 7y ago
      Those are still work related mails, though they get a better set of protection than normal work related mails.
  - brokenmachine 7y ago
    Interestingly, all emails sent from my work email have an auto-added disclaimer at the bottom saying effectively that anything contained is my own views, and not necessarily those of my employer. Companies can have their cake and eat it too.
    - zaarn 7y ago
      It depends on your company.
codeulike 7y ago
Its been clear from the start that emails would be covered by GDPR, and I believe that was the intent. edit: Official GDPR site, page on email: https://gdpr.eu/email-encryption/ https://gdpr.eu/email-encryption/ also, see the widely circulated 'GDPR letter from hell', which is a sort of worst-case access-to-data request that could be made under the legislation: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... In particular, please tell me what you know about me in your information systems, whether or not contained in databases, and including e-mail, documents on your networks, or voice or other media that you may store.
- GordonS 7y ago
  Has it? I've done much reading on the GDPR, and it certainly wasn't clear to me. "Data", of course - but regardless of technicality, I see email/slack/IM messages more as "personal communication" than "data".
  - codeulike 7y ago
    Yes definitely email/slack/and IM. The EU was not kidding around with this. Its a walloping huge piece of legislation with wide reaching implications.
- bhelkey 7y ago
  From elsewhere in this thread, here is an article from a year ago that dismisses using GDPR to access emails about you. https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-read-your-bosss-emails-about-you/ https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-re...
  - codeulike 7y ago
    .. based on what some lawyer said about case law, before the legislation even went live. Here's some discussion about it on the r/gdpr subreddit, the consensus seems to be emails probably are covered. https://www.reddit.com/r/gdpr/comments/8lsgwm/can_you_request_emails_that_include_your_name/ https://www.reddit.com/r/gdpr/comments/8lsgwm/can_you_reques... One person sums it up as: Emails that mention you are likely to count as personal data. However, your right to access that data must be balanced with the right to privacy of anyone else mentioned in the emails. The company would be entitled to redact the emails before sending them, and potentially to refuse the request entirely if that would require excessive effort.
pjc50 7y ago
This has been the case under the old data protection regime as well, and indeed I know someone else who used it against an educational institution who they suspected was blacklisting them - and also turned out to be right. It's squarely within the spirit of data protection as well. Are those emails data? Yes. Do they relate to you? Yes. Are they being used to make decisions which affect your employment? Also yes. Redacting the PII of others in the same emails is an extremely tricky problem though. The lesson of this and other things like the LIBOR chatroom has to be "don't conspire against people on your employer's computer systems". There is a flip side to blacklisting; one of the things that has emerged from the #metoo era is that many institutions had staff who were "missing stairs" - they were widely known to harass female staff, and the whisper networks propagated this, and even in some cases the male staff were aware that they shouldn't leave X alone with a female staff member, but no action was taken. GRPR forces institutions to be open with their disciplinary processes. You can't "shadowban" staff, unless you're willing to do it entirely verbally without ever committing to email.
- Silhouette 7y ago
  GRPR forces institutions to be open with their disciplinary processes. But a problem with this is that by the nature of disciplinary processes, it may or may not be appropriate to fully disclose what is being investigated to the subject of the investigation in real time. Much the same ethical and practical issues arise as when the police are investigating someone for suspected criminal behaviour. Indeed, in some cases, it may turn out that one becomes the other. Much the same ethical and practical issues may also arise as when dealing with any sort of whistle-blowing, where there is a clear interest in protecting the privacy of the whistle-blower as long as the matter they raise and any evidence they personally contribute can be properly validated and, where appropriate, properly challenged.
  - pjc50 7y ago
    GDPR allows you to stall people for at least a month, which is hardly "real time", and also to not disclose information which would affect the privacy of others.
istjohn 7y ago
I can't speak to European law, but in the US, work-related emails of government employees are subject to Freedom of Information Act requests. Sensitive information, like health or education data of individuals is redacted before it is released.
carapace 7y ago
I usually think about this issue in relation to driving: Do we (society) have the right to your driving performance data? In other words, if your car knows you drive like a reckless idiot should it "narc" on you? - - - - It seems to me that this sort of request means that our mental models of email have to change. This is incumbent anyway: most people still think email is private, when in fact it's more like postcards, in that anyone who handles it can read it. The misbegotten idea that you have any digital privacy in the absence of proper encryption has to die. (I don't like it, and am not advocating for it, I'm just calling it like I see it.)

bryanrasmussen 7y ago

yeah I would argue that was a data breach.

awakeasleep 7y ago

Interesting. In the USA emails are considered property of the employer. Outside of that, what is your take on the fact that there must be administrators that have the ability to look through all a system's email?

icebraining 7y ago

The GDPR does say "the right to obtain a copy (...) shall not adversely affect the rights and freedoms of others", but it doesn't spell out what that means. Still, your work email account can be monitored by your employer (though in the EU they have to provide notice of that monitoring), so you don't have the same protection as in a private account. OTOH, it could be a violation of privacy / data-protection for the author of this piece to be divulging the contents of these emails, even if they have a right to a copy.

GordonS 7y ago
> rights and freedoms of others", but it doesn't spell out what that means Hmm, that's unfortunate it's not at least a little more specific, but at the least I'd expect the right to lawful freedom of speech. I get that these are "work emails", but this just feels very wrong to me, and doesn't seem to fit with the intent of the GDPR.
- pjc50 7y ago
  How does this infringe on freedom of speech? You can still make the speech, but it may get back to the person you're speaking about. Which, in an employment context, is kind of necessary for procedural fairness.
  - GordonS 7y ago
    I disagree; it should be possible to have private conversations regarding work, while at work.
    - brokenmachine 7y ago
      If you don't use your work email address for such private emails then that's fine.
zaarn 7y ago
>though in the EU they have to provide notice of that monitoring There is an interesting exception; if private usage of your work mail account is banned, it should not contain private data and therefore, it's free to be monitored. Same for internet usage. This is usually coded into your contract when you sign.
- GordonS 7y ago
  Work emails can easily contain private data too. I might send an email to my manager asking for time off for deeply personal reasons, or informing them about very personal circumstances (e.g. health). There are of course numerous less impactful examples. An employer monitoring Internet usage is a very different case - in almost all cases it will be fully automated, and the logs only available to HR on request; not just any employee can request your logs.
  - brokenmachine 7y ago
    But those would only be discussing yourself. Nobody else would be able to request those emails.
  - zaarn 7y ago
    Those are still work related mails, though they get a better set of protection than normal work related mails.
- brokenmachine 7y ago
  Interestingly, all emails sent from my work email have an auto-added disclaimer at the bottom saying effectively that anything contained is my own views, and not necessarily those of my employer. Companies can have their cake and eat it too.
  - zaarn 7y ago
    It depends on your company.

codeulike 7y ago

Its been clear from the start that emails would be covered by GDPR, and I believe that was the intent. edit: Official GDPR site, page on email: https://gdpr.eu/email-encryption/ https://gdpr.eu/email-encryption/ also, see the widely circulated 'GDPR letter from hell', which is a sort of worst-case access-to-data request that could be made under the legislation: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... In particular, please tell me what you know about me in your information systems, whether or not contained in databases, and including e-mail, documents on your networks, or voice or other media that you may store.

GordonS 7y ago
Has it? I've done much reading on the GDPR, and it certainly wasn't clear to me. "Data", of course - but regardless of technicality, I see email/slack/IM messages more as "personal communication" than "data".
- codeulike 7y ago
  Yes definitely email/slack/and IM. The EU was not kidding around with this. Its a walloping huge piece of legislation with wide reaching implications.
bhelkey 7y ago
From elsewhere in this thread, here is an article from a year ago that dismisses using GDPR to access emails about you. https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-read-your-bosss-emails-about-you/ https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-re...
- codeulike 7y ago
  .. based on what some lawyer said about case law, before the legislation even went live. Here's some discussion about it on the r/gdpr subreddit, the consensus seems to be emails probably are covered. https://www.reddit.com/r/gdpr/comments/8lsgwm/can_you_request_emails_that_include_your_name/ https://www.reddit.com/r/gdpr/comments/8lsgwm/can_you_reques... One person sums it up as: Emails that mention you are likely to count as personal data. However, your right to access that data must be balanced with the right to privacy of anyone else mentioned in the emails. The company would be entitled to redact the emails before sending them, and potentially to refuse the request entirely if that would require excessive effort.

pjc50 7y ago

This has been the case under the old data protection regime as well, and indeed I know someone else who used it against an educational institution who they suspected was blacklisting them - and also turned out to be right. It's squarely within the spirit of data protection as well. Are those emails data? Yes. Do they relate to you? Yes. Are they being used to make decisions which affect your employment? Also yes. Redacting the PII of others in the same emails is an extremely tricky problem though. The lesson of this and other things like the LIBOR chatroom has to be "don't conspire against people on your employer's computer systems". There is a flip side to blacklisting; one of the things that has emerged from the #metoo era is that many institutions had staff who were "missing stairs" - they were widely known to harass female staff, and the whisper networks propagated this, and even in some cases the male staff were aware that they shouldn't leave X alone with a female staff member, but no action was taken. GRPR forces institutions to be open with their disciplinary processes. You can't "shadowban" staff, unless you're willing to do it entirely verbally without ever committing to email.

Silhouette 7y ago
GRPR forces institutions to be open with their disciplinary processes. But a problem with this is that by the nature of disciplinary processes, it may or may not be appropriate to fully disclose what is being investigated to the subject of the investigation in real time. Much the same ethical and practical issues arise as when the police are investigating someone for suspected criminal behaviour. Indeed, in some cases, it may turn out that one becomes the other. Much the same ethical and practical issues may also arise as when dealing with any sort of whistle-blowing, where there is a clear interest in protecting the privacy of the whistle-blower as long as the matter they raise and any evidence they personally contribute can be properly validated and, where appropriate, properly challenged.
- pjc50 7y ago
  GDPR allows you to stall people for at least a month, which is hardly "real time", and also to not disclose information which would affect the privacy of others.

istjohn 7y ago

I can't speak to European law, but in the US, work-related emails of government employees are subject to Freedom of Information Act requests. Sensitive information, like health or education data of individuals is redacted before it is released.

carapace 7y ago

I usually think about this issue in relation to driving: Do we (society) have the right to your driving performance data? In other words, if your car knows you drive like a reckless idiot should it "narc" on you? - - - - It seems to me that this sort of request means that our mental models of email have to change. This is incumbent anyway: most people still think email is private, when in fact it's more like postcards, in that anyone who handles it can read it. The misbegotten idea that you have any digital privacy in the absence of proper encryption has to die. (I don't like it, and am not advocating for it, I'm just calling it like I see it.)