4 ms·

I wonder what falls under this "access to data" law. Say Anna and Benjamin have email accounts with the same provider. Anna sends an email to Benjamin. Anna

by TekMol 3y ago

I wonder what falls under this "access to data" law. Say Anna and Benjamin have email accounts with the same provider. Anna sends an email to Benjamin. Anna deletes the email from her outbox. The provider still knows that Anna sent the email and the content. Because it is still in Benjamin's inbox. When Anna requests access to everything the provider knows about her - does the provider have to give her the email from Benjamin's inbox?

2Gkashmiri 3y ago
I don't think by that time it belongs to Anna. If an email existed on her mailbox, it would be hers. Once it was out of her email, she would not be able to claim ownership of it.
- M2Ys4U 3y ago
  It doesn't matter if Anna "owns" the data; The GDPR doesn't care who owns data. What matters is who controls it and what processing they do on it (with storage considered processing).
  - 2Gkashmiri 3y ago
    Does Anna have control over benjamins inbox?
    - M2Ys4U 3y ago
      No, but Benjamin does, so if Benjamin's use of Anna's personal data in the inbox is in scope of the GDPR then Anna has rights that she can enforce against Benjamin.
      - denton-scratch 3y ago
        I don't believe that GDPR applies to a mailing list, let alone to private email between individuals. Does someone have chapter and verse?
        cccbbbaaa 3y ago
        GDPR article 2(2)c. It will not apply to the receiver of the email, but maybe to the provider. Perhaps it depends on the kind of relationship between the two parties. Mailing lists will be covered. Side note: I know someone who requested their data to their DPA, and part of the response contained emails mentioning them and their complaints in the _content_ of the message (they were not in the From:, To:, Cc:, or Cci: fields). All names and emails address were censored, though, in accordance with 15(4).
        M2Ys4U 3y ago
        It depends - what's the purpose of the mailing list? If it's for purely personal or household purposes (e.g. a group of friends/family) then it's out of scope by virtue of Article 2(2)(c). Otherwise it'd likely be in scope with the list admin being the data controller.
      - b112 3y ago
        [flagged]
altacc 3y ago
The GDPR article 15 states that the data to be provided is "personal data", which is data that can be used to identify you. E.g. name, address, location, tracking ids. Text of an email does not come under personal data so not covered by the access to data law these people were testing. https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...
- a2128 3y ago
  Wouldn't it be considered personal data if the emails were to contain personal data? For example, emailing your shipping information or other personal data, signing off with your full name and phone number, etc.
  - avianlyric 3y ago
    Another test under GDPR is if the data is stored in a way designed to make looking it up easy. I forget the exact working, but broadly personal data stored in records designed to make looking up that data easy falls under a “right to data” request, and data that isn’t recorded like that doesn’t. As a consequence personal data that exists only within the content of an email wouldn’t be considered. Just like free form notes wouldn’t be considered, unless the notes were filled and recorded in a manner that made lookup easy. Then there’s also other people’s right to privacy. Your right to data doesn’t provide you with a right to intrude into other people privacy. So emails in your account, and records associated with your account are all fair game, but you don’t have a right to reach into other people’s account for data, or a right to force companies to perform super broad searches across every piece of data they have, just in case your name or similar appears in it. Of course all of these laws have space for interpretation, but that’s why we have courts. They’re ultimate arbiter of edge cases where it’s not clear what the correct cause of action is.
- TekMol 3y ago
  Your link gives "an email address" as one of the examples for personal data. And Anna's email address is part of the email in Benjamin's inbox.
valyagolev 3y ago
it's an interesting question, but i think the "right" answer here would be that the emails should (in the rfc sense of the word) be end-to-end encrypted, thus there wouldn't be a way to do this at all
M2Ys4U 3y ago
The email provider in this scenario is almost certainly not the data controller - Benjamin is - so no. And if Benjamin is using their email inbox in a purely personal manner then it'd be out of scope of the GDPR entirely.

by TekMol 3y ago

2Gkashmiri 3y ago

I don't think by that time it belongs to Anna. If an email existed on her mailbox, it would be hers. Once it was out of her email, she would not be able to claim ownership of it.

M2Ys4U 3y ago
It doesn't matter if Anna "owns" the data; The GDPR doesn't care who owns data. What matters is who controls it and what processing they do on it (with storage considered processing).
- 2Gkashmiri 3y ago
  Does Anna have control over benjamins inbox?
  - M2Ys4U 3y ago
    No, but Benjamin does, so if Benjamin's use of Anna's personal data in the inbox is in scope of the GDPR then Anna has rights that she can enforce against Benjamin.
    - denton-scratch 3y ago
      I don't believe that GDPR applies to a mailing list, let alone to private email between individuals. Does someone have chapter and verse?
      - cccbbbaaa 3y ago
        GDPR article 2(2)c. It will not apply to the receiver of the email, but maybe to the provider. Perhaps it depends on the kind of relationship between the two parties. Mailing lists will be covered. Side note: I know someone who requested their data to their DPA, and part of the response contained emails mentioning them and their complaints in the _content_ of the message (they were not in the From:, To:, Cc:, or Cci: fields). All names and emails address were censored, though, in accordance with 15(4).
      - M2Ys4U 3y ago
        It depends - what's the purpose of the mailing list? If it's for purely personal or household purposes (e.g. a group of friends/family) then it's out of scope by virtue of Article 2(2)(c). Otherwise it'd likely be in scope with the list admin being the data controller.
    - b112 3y ago
      [flagged]

altacc 3y ago

The GDPR article 15 states that the data to be provided is "personal data", which is data that can be used to identify you. E.g. name, address, location, tracking ids. Text of an email does not come under personal data so not covered by the access to data law these people were testing. https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...

a2128 3y ago
Wouldn't it be considered personal data if the emails were to contain personal data? For example, emailing your shipping information or other personal data, signing off with your full name and phone number, etc.
- avianlyric 3y ago
  Another test under GDPR is if the data is stored in a way designed to make looking it up easy. I forget the exact working, but broadly personal data stored in records designed to make looking up that data easy falls under a “right to data” request, and data that isn’t recorded like that doesn’t. As a consequence personal data that exists only within the content of an email wouldn’t be considered. Just like free form notes wouldn’t be considered, unless the notes were filled and recorded in a manner that made lookup easy. Then there’s also other people’s right to privacy. Your right to data doesn’t provide you with a right to intrude into other people privacy. So emails in your account, and records associated with your account are all fair game, but you don’t have a right to reach into other people’s account for data, or a right to force companies to perform super broad searches across every piece of data they have, just in case your name or similar appears in it. Of course all of these laws have space for interpretation, but that’s why we have courts. They’re ultimate arbiter of edge cases where it’s not clear what the correct cause of action is.
TekMol 3y ago
Your link gives "an email address" as one of the examples for personal data. And Anna's email address is part of the email in Benjamin's inbox.

valyagolev 3y ago

it's an interesting question, but i think the "right" answer here would be that the emails should (in the rfc sense of the word) be end-to-end encrypted, thus there wouldn't be a way to do this at all

M2Ys4U 3y ago

The email provider in this scenario is almost certainly not the data controller - Benjamin is - so no. And if Benjamin is using their email inbox in a purely personal manner then it'd be out of scope of the GDPR entirely.