What subject access rights exist when only some of the data relates to you?

Question

If some data record exists where some of the data relates to person A (eg. telephone number) while other data does not (eg. name), what right of access does person A have to that record under the GDPR?

I received two unsolicited marketing contacts, and suspecting harassment I made subject access requests to both. After providing my name to one of them, they said that was not the name on the record and declined to provide me any further information, but offered to delete the telephone number they held. When contacting the other I refused to provide my name, and they provided the name on the record (not mine) and contact details for the company from which they bought the record. This allowed me to make a subject access request to that company, and potentially get to the source of the incorrect data. This is impossible with the first company.

What are my rights in this situation? If I inform a company that is selling my telephone number that the name they are selling with it is incorrect, do I lose my right to find out who is selling it to whom?

Answer 1

Your rights are unaffected

To be clear, your phone number of itself is personal data as defined in the GDPR. All you require to make a Data Access Request (DAR) is proof that it is your phone number.

The recipient of your DAR is required to provide you with the data they have about you and:

• why they have it
• the categories of data they have
• who they’ve shared it with
• how long they intend to keep it
• the fact that you can have it corrected
• the fact that you can complain about them to the supervising body
• where they got it from
• what automated decisions are based on the data
• the safeguards that exist if it’s sent outside the EU

Now, all of the above is subject to the limitation that it cannot infringe another person’s rights. So, where personal data is mixed, the data that isn’t yours should be redacted in some way.