I have made a subject access request, and the result included:
- Statement that their right to process data is from Article 6(1)(b)
- A series of images, that appear to be photographs of a computer monitor, with my data displayed within some unrecognised application (presumably internal and/or proprietary software)
I have requested the data in a structured, commonly used and machine-readable format. They have responded saying screenshots are appropriate and they cannot do otherwise.
I am fairly sure what they provide is not consistent with Article 20(1). I note that article 20(2) includes "where technically feasible" but article 20(1) does not. However I am not at all sure what this would look like in practice. Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? Am I within my rights to insist on this, even if to comply they would have to do some software development? Assuming there is a database underlying the application I would expect it to be a DDL of the database structure, and the relevant insert statements. However this is likely to be very difficult to provide if it is a closed source proprietary application.