3 ms·

Not quite. If, for example, you used a 3rd party to get data about me, that's still my personal data. Whether I explicitly gave it to you or not is immaterial.

by edent 2y ago

Not quite. If, for example, you used a 3rd party to get data about me, that's still my personal data. Whether I explicitly gave it to you or not is immaterial. If I have given you my email address, and then you process it, I think I am entitled to know how you've processed it. If you've stuck it in a DB, forwarded it to people via IM, or put it in a spreadsheet, etc. You may think it is absurd, but my experience of filing DSARs is that most companies will send a suitably redacted copy of everywhere my data has been. And, yes, that includes emails.

rglullis 2y ago
> I am entitled to know how you've processed it. How: "your email address is stored in our servers and kept until your account is active, then delete 90 days after. We also may share it with Jane Corp, because you gave us consent to, but not David Inc, because you did not give consent for it" You are asking "show me the complete record of my ban, because I want to know who did it and I am entitled to it because that requires someone knowing some of PII." It's not that your data ended up somewhere you did not consent to or that they did not tell you how your data is processed, you are just uttering "gee-dee-pee-arr" and expecting to be enough to give you some information about you. Are you sure that this is the intent of the law?
- edent 2y ago
  > Are you sure that this is the intent of the law? Yes. At least, that's my reading of https://www.legislation.gov.uk/eur/2016/679 https://www.legislation.gov.uk/eur/2016/679 If a decision has been made about me, I have the right to get information about it. You are, of course, free to disagree.
  - rglullis 2y ago
    To repeat the example a gave in a sibling thread: you can not go to a dating site filing GDPR requests to find out who liked/disliked you. That would be a violation of their privacy.
    - edent 2y ago
      Yes, I agree. There are competing rights. When I've received internal emails about me, the sender's name and contact details have been redacted. That's both normal and expected.
      - belorn 2y ago
        The ICO has information regarding such requests, like https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/subject-access-request-q-and-as-for-employers/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... which discuss internal emails. There is a lot of exceptions and area for redaction, but the most significant in this case would be disclosing information that identifies another individual. As an example they have a fictional employee requesting a HR file. The HR file is likely to include information identifying managers and colleagues, or may include revealing information that relates to and identifies another individual. Redacting the names could be enough, or the emails might be heavily redacted down to only strict information regarding the employee without any parts of decisions or input given by the manager. If the intent of the requester is to get "what did my manager say about me", then that would not be valid.

by edent 2y ago

rglullis 2y ago

> I am entitled to know how you've processed it. How: "your email address is stored in our servers and kept until your account is active, then delete 90 days after. We also may share it with Jane Corp, because you gave us consent to, but not David Inc, because you did not give consent for it" You are asking "show me the complete record of my ban, because I want to know who did it and I am entitled to it because that requires someone knowing some of PII." It's not that your data ended up somewhere you did not consent to or that they did not tell you how your data is processed, you are just uttering "gee-dee-pee-arr" and expecting to be enough to give you some information about you. Are you sure that this is the intent of the law?

edent 2y ago
> Are you sure that this is the intent of the law? Yes. At least, that's my reading of https://www.legislation.gov.uk/eur/2016/679 https://www.legislation.gov.uk/eur/2016/679 If a decision has been made about me, I have the right to get information about it. You are, of course, free to disagree.
- rglullis 2y ago
  To repeat the example a gave in a sibling thread: you can not go to a dating site filing GDPR requests to find out who liked/disliked you. That would be a violation of their privacy.
  - edent 2y ago
    Yes, I agree. There are competing rights. When I've received internal emails about me, the sender's name and contact details have been redacted. That's both normal and expected.
    - belorn 2y ago
      The ICO has information regarding such requests, like https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/subject-access-request-q-and-as-for-employers/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... which discuss internal emails. There is a lot of exceptions and area for redaction, but the most significant in this case would be disclosing information that identifies another individual. As an example they have a fictional employee requesting a HR file. The HR file is likely to include information identifying managers and colleagues, or may include revealing information that relates to and identifies another individual. Redacting the names could be enough, or the emails might be heavily redacted down to only strict information regarding the employee without any parts of decisions or input given by the manager. If the intent of the requester is to get "what did my manager say about me", then that would not be valid.