4 ms·

>I was able to ask my PhD college, and several other institutions, to see all emails in which my name appeared in either the subject line or the body of the ema

by Grue3 7y ago

>I was able to ask my PhD college, and several other institutions, to see all emails in which my name appeared in either the subject line or the body of the email. The scariest part is that this is apparently possible in countries under the jurisdiction of GDPR now (and possibly even outside of it). Your private emails talking about a third party might be exposed at the request of the said third party. Does no one else consider this extremely concerning?

Silhouette 7y ago
There is certainly an ethical challenge in balancing privacy and data protection issues when there is more than one subject involved, as in this case with both the PhD graduate and those other parties whose emails referred to them. It seems a terrible precedent if any communications service may in general be required to disclose the otherwise private communications of its users if they happen to mention any individual by name (or, presumably, any other identifying features, since this is the GDPR). On the other hand, for matters of professional/business correspondence that relate to a specific individual, where the information being stored or shared around may be incorrect or misleading and the individual is being personally harmed as a result, isn't that exactly the sort of problem that data protection laws (and the anti-blacklisting laws, and defamation laws more generally, for that matter) are trying to fix? It doesn't make any practical difference whether the questionable personal data happens to be stored in something structured like a formal employee record or in unstructured form through emails shared by other staff. It's the data, how it's being used and who is using it that matter the most.
gota 7y ago
Regulations that are stronger than they should are made to be broken and circumvented. There's at least one likely future in which, following a couple multi-million lawsuit baseds on such requests, a kind of 'blind referencing' becomes the norm, taught and enforced by companies and organizations. "Never refer to individuals by name, use the Company Directory's Hash Function". Or something silly like that. Just like companies delete employees emails in the second they are allowed to do so by law - can you imagine if the law was to keep them forever? We'd have extreme changes in email formats and technology every decade or so, to render it impossible to read old-enough emails from disgruntled ex-employees and etc.
pjc50 7y ago
You are the "data controller" for your own emails. Emails stored on your employer's system are under their remit as the "data controller" to whom the subject access requests will be made. Emails on your employer's system are "your" or "private" only in a very limited sense. GDPR does not entitle random people to leaf through your gmail. (Even without data protection law this kind of thing can still happen during the "discovery" process of a lawsuit, but that's a much higher bar.)
- Silhouette 7y ago
  This issue still seems to be much more ambiguous than good law should be. Here is an article from just over a year ago, in which an actual lawyer specialising in IT and privacy is quoted, explaining how something remarkably similar to the situation we're discussing today wasn't going to happen and it was all fear and misinterpretation: https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-read-your-bosss-emails-about-you/ https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-re...
  - bhelkey 7y ago
    > However, European case law clearly states that data such as emails your boss has sent about you is exempt from this. > “The reason behind this exemption is that those internal messages contain the personal thoughts of your boss. The right of access does not extend to all the personal messages, thoughts and ideas people have about you. So, based on the GDPR, you will not be able to access them,” says Zadeh. Oops.
awinder 7y ago
I'm pretty sure that this would only apply in the contexts of business dealings -- anything you produce from a business you work for should not be considered your private anything, it's work material you produced for that employer, and the actions became the employer's actions after executed.
- Grue3 7y ago
  Even in business context this can be weaponised. For example two executives in a company discuss some sort of business strategy and mention the competitor's CEO by name (also the competitor's company happens to be named after its CEO so it's impossible to discuss it without saying his or her name). The competitor's CEO GDPRs the emails and learns of the secret business plan as a result.
  - Silhouette 7y ago
    Even in business context this can be weaponised. Indeed. Just imagine the fall-out if someone started a movement where everyone who got turned down for a job they applied for then submitted a SAR for all of the internal commentary and communications about them. Suddenly every business that hires staff has an extra overhead, even small businesses need industrial-scale HR/legal mechanics for the application process, and the number of lawsuits for every conceivable type of discrimination skyrockets.
    - awinder 7y ago
      This is already a concern (not the absence of hiring documentation, but extreme caution around what is captured into electronic long-term storage), pre-and-post GDPR. "Pick up the phone" is a very real piece of advice around hiring-related conversations and for good reasons. I think it's incredibly contorted to believe the world falls apart here (in fact, the world would have to be pretty broken in order for it to go down that way).
Dayshine 7y ago
From the UK's ICO on the GDPR: > Domestic purposes – personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity, is outside the GDPR’s scope. This means that if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the GDPR. "Your private emails" are therefore not covered by the GDPR. Unless your definition of "your" private emails includes those you send in your work capacity?
- Silhouette 7y ago
  "Your private emails" are therefore not covered by the GDPR. But as soon as a commercial third party mail service is involved, as will very often be the case, the picture is not so clear, particularly if they are also processing the data for any other purpose.

by Grue3 7y ago

Silhouette 7y ago

There is certainly an ethical challenge in balancing privacy and data protection issues when there is more than one subject involved, as in this case with both the PhD graduate and those other parties whose emails referred to them. It seems a terrible precedent if any communications service may in general be required to disclose the otherwise private communications of its users if they happen to mention any individual by name (or, presumably, any other identifying features, since this is the GDPR). On the other hand, for matters of professional/business correspondence that relate to a specific individual, where the information being stored or shared around may be incorrect or misleading and the individual is being personally harmed as a result, isn't that exactly the sort of problem that data protection laws (and the anti-blacklisting laws, and defamation laws more generally, for that matter) are trying to fix? It doesn't make any practical difference whether the questionable personal data happens to be stored in something structured like a formal employee record or in unstructured form through emails shared by other staff. It's the data, how it's being used and who is using it that matter the most.

gota 7y ago

Regulations that are stronger than they should are made to be broken and circumvented. There's at least one likely future in which, following a couple multi-million lawsuit baseds on such requests, a kind of 'blind referencing' becomes the norm, taught and enforced by companies and organizations. "Never refer to individuals by name, use the Company Directory's Hash Function". Or something silly like that. Just like companies delete employees emails in the second they are allowed to do so by law - can you imagine if the law was to keep them forever? We'd have extreme changes in email formats and technology every decade or so, to render it impossible to read old-enough emails from disgruntled ex-employees and etc.

pjc50 7y ago

You are the "data controller" for your own emails. Emails stored on your employer's system are under their remit as the "data controller" to whom the subject access requests will be made. Emails on your employer's system are "your" or "private" only in a very limited sense. GDPR does not entitle random people to leaf through your gmail. (Even without data protection law this kind of thing can still happen during the "discovery" process of a lawsuit, but that's a much higher bar.)

Silhouette 7y ago
This issue still seems to be much more ambiguous than good law should be. Here is an article from just over a year ago, in which an actual lawyer specialising in IT and privacy is quoted, explaining how something remarkably similar to the situation we're discussing today wasn't going to happen and it was all fear and misinterpretation: https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-read-your-bosss-emails-about-you/ https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-re...
- bhelkey 7y ago
  > However, European case law clearly states that data such as emails your boss has sent about you is exempt from this. > “The reason behind this exemption is that those internal messages contain the personal thoughts of your boss. The right of access does not extend to all the personal messages, thoughts and ideas people have about you. So, based on the GDPR, you will not be able to access them,” says Zadeh. Oops.

awinder 7y ago

I'm pretty sure that this would only apply in the contexts of business dealings -- anything you produce from a business you work for should not be considered your private anything, it's work material you produced for that employer, and the actions became the employer's actions after executed.

Grue3 7y ago
Even in business context this can be weaponised. For example two executives in a company discuss some sort of business strategy and mention the competitor's CEO by name (also the competitor's company happens to be named after its CEO so it's impossible to discuss it without saying his or her name). The competitor's CEO GDPRs the emails and learns of the secret business plan as a result.
- Silhouette 7y ago
  Even in business context this can be weaponised. Indeed. Just imagine the fall-out if someone started a movement where everyone who got turned down for a job they applied for then submitted a SAR for all of the internal commentary and communications about them. Suddenly every business that hires staff has an extra overhead, even small businesses need industrial-scale HR/legal mechanics for the application process, and the number of lawsuits for every conceivable type of discrimination skyrockets.
  - awinder 7y ago
    This is already a concern (not the absence of hiring documentation, but extreme caution around what is captured into electronic long-term storage), pre-and-post GDPR. "Pick up the phone" is a very real piece of advice around hiring-related conversations and for good reasons. I think it's incredibly contorted to believe the world falls apart here (in fact, the world would have to be pretty broken in order for it to go down that way).

Dayshine 7y ago

From the UK's ICO on the GDPR: > Domestic purposes – personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity, is outside the GDPR’s scope. This means that if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the GDPR. "Your private emails" are therefore not covered by the GDPR. Unless your definition of "your" private emails includes those you send in your work capacity?

Silhouette 7y ago
"Your private emails" are therefore not covered by the GDPR. But as soon as a commercial third party mail service is involved, as will very often be the case, the picture is not so clear, particularly if they are also processing the data for any other purpose.