3 ms·
I don’t think that’s correct? Section 39 doesn’t say anything about data you’ve provided, but data that’s collected: the onus is on the data processor to proces
by robin_reala 2y ago
I don’t think that’s correct? Section 39 doesn’t say anything about data you’ve provided, but data that’s collected: the onus is on the data processor to process data in a legitimate way.
- rglullis 2y agoCollected does not mean synthesized. Imagine I am in a dating site and want to find out all the people that expressed interest on me. I go then and file a GDPR request, claiming that those that mentions of me is "data collected about me" and therefore I am entitled to it. Someone talking about you, or references about your PII are not PII themselves. To try to claim otherwise is absurd.
- jeroenhd 2y agoI don't believe the "I'm entitled to all messages discussing me because of the GDPR" is correct, though the UK GPDR may be different in a way I don't know about. It's an interesting take (what is "data" anyway? does it include "the CEO thinks <person> is a dick" if that record is kept on company infrastructure?) but I don't think it'll hold up in court. If the author decides to press the ICO to take action, perhaps we may find out one day. That said, scraped data about you definitely falls under GDPR protections even if you never provided any data yourself.