Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways
It seems most buildings store the activity of one's RFID key activity.
In the era of GDPR, I was wondering whether I would be allowed to ask for that data or ask for that data to be destroyed?
I would start by enquiring as to WHICH Personal Data they have about you and if any was obtained via "Track and Tracing" (RFID).
If the answer is YES, I would further inquire about the Lawful Base (since, and assuming you have not Consent to it), plus processing "purpose" and "scope".
If they argue Legitimate Interest, you can request the performed Impact Assessment and based on the answer you have documented grounds to demand it's erasure or at least a confirmation of processing "scope" limitation, that you may resort to if a dispute arises.
It helps to get documented proof... and this is one linear way to do it.
You can ask for the data, but the data controller would probably refuse on the ground that it might not have been you carrying the key at the time, and he cannot disclose data possibly relating to another person.
You can ask for the data to be destroyed, but the same argument might apply - that the retained data does not relate to you, but relates to another person.
The situation may be different depending on whether a set of keys are issued to an apartment and the apartment occupiers use whichever key is convenient, or a specific key is issed to an individual for his personal use (such as an employee pass).
The building owner should have a retention policy so that key data is destroyed after a certain period. It should not be kept indefinately.
