4 ms·

The GDPR article 15 states that the data to be provided is "personal data", which is data that can be used to identify you. E.g. name, address, location, tracki

by altacc 3y ago

The GDPR article 15 states that the data to be provided is "personal data", which is data that can be used to identify you. E.g. name, address, location, tracking ids. Text of an email does not come under personal data so not covered by the access to data law these people were testing. https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...

a2128 3y ago
Wouldn't it be considered personal data if the emails were to contain personal data? For example, emailing your shipping information or other personal data, signing off with your full name and phone number, etc.
- avianlyric 3y ago
  Another test under GDPR is if the data is stored in a way designed to make looking it up easy. I forget the exact working, but broadly personal data stored in records designed to make looking up that data easy falls under a “right to data” request, and data that isn’t recorded like that doesn’t. As a consequence personal data that exists only within the content of an email wouldn’t be considered. Just like free form notes wouldn’t be considered, unless the notes were filled and recorded in a manner that made lookup easy. Then there’s also other people’s right to privacy. Your right to data doesn’t provide you with a right to intrude into other people privacy. So emails in your account, and records associated with your account are all fair game, but you don’t have a right to reach into other people’s account for data, or a right to force companies to perform super broad searches across every piece of data they have, just in case your name or similar appears in it. Of course all of these laws have space for interpretation, but that’s why we have courts. They’re ultimate arbiter of edge cases where it’s not clear what the correct cause of action is.
TekMol 3y ago
Your link gives "an email address" as one of the examples for personal data. And Anna's email address is part of the email in Benjamin's inbox.
- altacc 3y ago
  Anna's email address is not Benjamin's personal data. The GDPR requirement is for the requester's personal data, not personal data of anyone else.
M2Ys4U 3y ago
>"personal data", which is data that can be used to identify you. E.g. name, address, location, tracking ids. This is wrong - very wrong. Article 4 defines personal data: "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"

by altacc 3y ago

a2128 3y ago

Wouldn't it be considered personal data if the emails were to contain personal data? For example, emailing your shipping information or other personal data, signing off with your full name and phone number, etc.

avianlyric 3y ago
Another test under GDPR is if the data is stored in a way designed to make looking it up easy. I forget the exact working, but broadly personal data stored in records designed to make looking up that data easy falls under a “right to data” request, and data that isn’t recorded like that doesn’t. As a consequence personal data that exists only within the content of an email wouldn’t be considered. Just like free form notes wouldn’t be considered, unless the notes were filled and recorded in a manner that made lookup easy. Then there’s also other people’s right to privacy. Your right to data doesn’t provide you with a right to intrude into other people privacy. So emails in your account, and records associated with your account are all fair game, but you don’t have a right to reach into other people’s account for data, or a right to force companies to perform super broad searches across every piece of data they have, just in case your name or similar appears in it. Of course all of these laws have space for interpretation, but that’s why we have courts. They’re ultimate arbiter of edge cases where it’s not clear what the correct cause of action is.

TekMol 3y ago

Your link gives "an email address" as one of the examples for personal data. And Anna's email address is part of the email in Benjamin's inbox.

altacc 3y ago
Anna's email address is not Benjamin's personal data. The GDPR requirement is for the requester's personal data, not personal data of anyone else.

M2Ys4U 3y ago

>"personal data", which is data that can be used to identify you. E.g. name, address, location, tracking ids. This is wrong - very wrong. Article 4 defines personal data: "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"