1

Lets say a company stores information in Catagory 1 , 2 , 3 .Catagory 1 in formation is assciated with email , Cata gory 2 with user name and catagory 3 with phone number.A user sends a request via email and writes "give (the user) a copy of the data." Does the company send only catagory 1 data or ask for more information and send more data for catagory 2 and 3?

Improve this question
1

1 Answer 1

Reset to default
2

Interpreting Art. 15 GDPR "Right of access by the data subject" I would think that the company in your scenario has to send all data which they have collected about the user, after the user is identified by e.g. email address. Plus other information like e.g. the purposes of the processing, see all bullet points in the link.

If you have user data associated with a user-name and other data associated with a phone-number, how can you find out that this is the same user? In your scenario the best way would be to state in the privacy policy, that the user has to provide username plus full name plus phone-number in his request. Or you redesign your data collection procedure to avoid this issue. If you provide only part of the data you might need to prove why, which might require some effort.

Is one possible scenario you think of e.g. having a newsletter based on email addresses, and, independently a webform where one can give name and phone-number?

Improve this answer
5
  • Did you understand my question?I wanted to say that catagory 2 and 3 is inaccessible without the user providing his phone number and username.In that case should one send the catagory 1 information or ask for phone number and username to send catagory 2 and 3 information.
    – protectgoodlivingbeingask
    Commented Nov 22, 2020 at 18:49
  • Sorry, I extended my answer accordingly.
    – UweD
    Commented Nov 22, 2020 at 19:24
  • Don't say "sorry" .I don't like hearing that.So Privacy policy clause will bw a solution.What I was also thinking about was IP logs.To giveuser their ip logs more information like timestamp may be needed but that doesn't mean I can't give rest info.
    – protectgoodlivingbeingask
    Commented Nov 23, 2020 at 3:42
  • Yes, the IP logs should be handed out as well.
    – UweD
    Commented Nov 23, 2020 at 5:42
  • I meant b I cannot give ip logs until I know the timestamp.law.stackexchange.com/questions/58151/… they don't send me timestamp I will give rest of the information.
    – protectgoodlivingbeingask
    Commented Nov 23, 2020 at 5:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .