3 ms·

Another case of people thinking that GDPR is a magic word that can make any wish come true. > I replied with a (not so-friendly) email pointing out that I was

Another case of people thinking that GDPR is a magic word that can make any wish come true. > I replied with a (not so-friendly) email pointing out that I was entitled to a copy of any messages because they contain my personal data. Hum, no? You are entitled to a copy of the data that you provided to the data processor. Your messages, your records, even your IP address for the sessions on your devices. A message that someone mentions you is not your data.

robin_reala 2y ago
I don’t think that’s correct? Section 39 doesn’t say anything about data you’ve provided, but data that’s collected: the onus is on the data processor to process data in a legitimate way.
- rglullis 2y ago
  Collected does not mean synthesized. Imagine I am in a dating site and want to find out all the people that expressed interest on me. I go then and file a GDPR request, claiming that those that mentions of me is "data collected about me" and therefore I am entitled to it. Someone talking about you, or references about your PII are not PII themselves. To try to claim otherwise is absurd.
- jeroenhd 2y ago
  I don't believe the "I'm entitled to all messages discussing me because of the GDPR" is correct, though the UK GPDR may be different in a way I don't know about. It's an interesting take (what is "data" anyway? does it include "the CEO thinks <person> is a dick" if that record is kept on company infrastructure?) but I don't think it'll hold up in court. If the author decides to press the ICO to take action, perhaps we may find out one day. That said, scraped data about you definitely falls under GDPR protections even if you never provided any data yourself.
edent 2y ago
I don't think you are correct. It doesn't matter who provides the data. > If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month. https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/ https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and... I was asking for how my data was being processed. An email saying "Please perform action XYZ on this specific user" would, I think, fall under that description.
- mlhpdx 2y ago
  This is my understanding as well. What matters is that the records contain PII, not where it came from.
- rglullis 2y ago
  > If you obtain personal data from other sources, This is the case where you are a website, e.g, using "Login via GitHub" and GitHub sent you the users email address. What you are asking is for a third party to tell you of any possible instance where your email address is mentioned. This is absurd.
  - edent 2y ago
    Not quite. If, for example, you used a 3rd party to get data about me, that's still my personal data. Whether I explicitly gave it to you or not is immaterial. If I have given you my email address, and then you process it, I think I am entitled to know how you've processed it. If you've stuck it in a DB, forwarded it to people via IM, or put it in a spreadsheet, etc. You may think it is absurd, but my experience of filing DSARs is that most companies will send a suitably redacted copy of everywhere my data has been. And, yes, that includes emails.
    - rglullis 2y ago
      > I am entitled to know how you've processed it. How: "your email address is stored in our servers and kept until your account is active, then delete 90 days after. We also may share it with Jane Corp, because you gave us consent to, but not David Inc, because you did not give consent for it" You are asking "show me the complete record of my ban, because I want to know who did it and I am entitled to it because that requires someone knowing some of PII." It's not that your data ended up somewhere you did not consent to or that they did not tell you how your data is processed, you are just uttering "gee-dee-pee-arr" and expecting to be enough to give you some information about you. Are you sure that this is the intent of the law?
      - edent 2y ago
deleted 2y ago
[deleted]
graemep 2y ago
Natwest/Coutts gave Nigel Farage internally generated documents about him in response to a subject access request (according to this and my memory of other reports https://news.sky.com/story/key-points-from-coutts-dossier-on-nigel-farage-12924078 https://news.sky.com/story/key-points-from-coutts-dossier-on... ). Its not something that they would have done unless they had to and I assume they have competent lawyers so it does look like you can request copies of email about you. its looks like internal discussions about someone are within scope of GDPR.
- rglullis 2y ago
  This case is odd. I haven't heard a single lawyer saying that a conversation talking about someone undoubtedly qualify as protected data, so I'm more inclined to believe that Farage was already in possession of those emails (or made aware of them) and the bank thought that trying to hide them would make things worse?
x0x0 2y ago
> You are entitled to a copy of the data that you provided to the data processor This is absolute nonsense and there is no such limitation in the GDPR which, if you had even a passing familiarity with it, you would know. Maybe don't ramble about things you don't understand? In particular, art 14 is: > Information to be provided where personal data have not been obtained from the data subject https://gdpr-info.eu/art-14-gdpr/ https://gdpr-info.eu/art-14-gdpr/

robin_reala 2y ago

I don’t think that’s correct? Section 39 doesn’t say anything about data you’ve provided, but data that’s collected: the onus is on the data processor to process data in a legitimate way.

rglullis 2y ago
Collected does not mean synthesized. Imagine I am in a dating site and want to find out all the people that expressed interest on me. I go then and file a GDPR request, claiming that those that mentions of me is "data collected about me" and therefore I am entitled to it. Someone talking about you, or references about your PII are not PII themselves. To try to claim otherwise is absurd.
jeroenhd 2y ago
I don't believe the "I'm entitled to all messages discussing me because of the GDPR" is correct, though the UK GPDR may be different in a way I don't know about. It's an interesting take (what is "data" anyway? does it include "the CEO thinks <person> is a dick" if that record is kept on company infrastructure?) but I don't think it'll hold up in court. If the author decides to press the ICO to take action, perhaps we may find out one day. That said, scraped data about you definitely falls under GDPR protections even if you never provided any data yourself.

edent 2y ago

I don't think you are correct. It doesn't matter who provides the data. > If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month. https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/ https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and... I was asking for how my data was being processed. An email saying "Please perform action XYZ on this specific user" would, I think, fall under that description.

mlhpdx 2y ago
This is my understanding as well. What matters is that the records contain PII, not where it came from.
rglullis 2y ago
> If you obtain personal data from other sources, This is the case where you are a website, e.g, using "Login via GitHub" and GitHub sent you the users email address. What you are asking is for a third party to tell you of any possible instance where your email address is mentioned. This is absurd.
- edent 2y ago
  Not quite. If, for example, you used a 3rd party to get data about me, that's still my personal data. Whether I explicitly gave it to you or not is immaterial. If I have given you my email address, and then you process it, I think I am entitled to know how you've processed it. If you've stuck it in a DB, forwarded it to people via IM, or put it in a spreadsheet, etc. You may think it is absurd, but my experience of filing DSARs is that most companies will send a suitably redacted copy of everywhere my data has been. And, yes, that includes emails.
  - rglullis 2y ago
    > I am entitled to know how you've processed it. How: "your email address is stored in our servers and kept until your account is active, then delete 90 days after. We also may share it with Jane Corp, because you gave us consent to, but not David Inc, because you did not give consent for it" You are asking "show me the complete record of my ban, because I want to know who did it and I am entitled to it because that requires someone knowing some of PII." It's not that your data ended up somewhere you did not consent to or that they did not tell you how your data is processed, you are just uttering "gee-dee-pee-arr" and expecting to be enough to give you some information about you. Are you sure that this is the intent of the law?
    - edent 2y ago

deleted 2y ago

[deleted]

graemep 2y ago

Natwest/Coutts gave Nigel Farage internally generated documents about him in response to a subject access request (according to this and my memory of other reports https://news.sky.com/story/key-points-from-coutts-dossier-on-nigel-farage-12924078 https://news.sky.com/story/key-points-from-coutts-dossier-on... ). Its not something that they would have done unless they had to and I assume they have competent lawyers so it does look like you can request copies of email about you. its looks like internal discussions about someone are within scope of GDPR.

rglullis 2y ago
This case is odd. I haven't heard a single lawyer saying that a conversation talking about someone undoubtedly qualify as protected data, so I'm more inclined to believe that Farage was already in possession of those emails (or made aware of them) and the bank thought that trying to hide them would make things worse?

x0x0 2y ago

> You are entitled to a copy of the data that you provided to the data processor This is absolute nonsense and there is no such limitation in the GDPR which, if you had even a passing familiarity with it, you would know. Maybe don't ramble about things you don't understand? In particular, art 14 is: > Information to be provided where personal data have not been obtained from the data subject https://gdpr-info.eu/art-14-gdpr/ https://gdpr-info.eu/art-14-gdpr/