If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?

Question

Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with responsibilities to Bob? Looking at the exemptions on the ICO site it does not seem that "Domestic purposes" would really cover it, as there is a connection to "professional or commercial activity" in that the data was received from such a commercial entity.

The case in question involves the response to a SAR made to a large nationally famous company. This contained a number of PDF files with embedded metadata that appears to be the name, contact email and browser user agent string of the individuals who produced the document. Considering the level of professionalism on display concerning this SAR it is quite possible the company is unaware that they are distributing this PII, but equally it is possible that they are doing it so as to restrict the possible uses this data can be put to, for example I would not want to share these online because of the expose of others PII. It is impossible to do anything with these documents without "processing" this data, it is read automatically as the documents are opened.

Answer 1

Looking at the exemptions on the ICO site it does not seem that "Domestic purposes" would really cover it, as there is a connection to "professional or commercial activity" in that the data was received from such a commercial entity.

The fact that Alice makes a personal SAR of a business does not mean her activity is professional or commercial.

Assuming Alice is a member of the public acting in a personal or household capacity, e.g. she wants to know what data a business holds relating to her/her household, she doesn't become a 'data controller' or 'data processor' if she receives data relating to Bob and other members of the public.

Answer 2

Depends on the purpose for which this personal data is used.

Presumably, Alice made the DSAR for purely personal or household purposes. If she uses the received third party personal data in line with those purposes, the GDPR will not apply. If she uses the received data for different purposes, she would be acting as a data controller and would need a legal basis. For example, if Alice works in insurance sales and then uses Bob's email address to send him marketing material, that wouldn't be covered by the household exception and Alice would be breaching the GDPR (and ePrivacy/PECR).

The “household exception” refers to Alice's purposes. GDPR does not apply just because some business was involved. One of the main purposes is to ensure that normal social media use is out of scope of the GDPR, so that social media companies (like Facebook) can't skirt their responsibilities.

it is quite possible the company is unaware that they are distributing this PII

If the controller inadvertently disclosed personal data, that would be a data breach. You are not required to, but you might want to notify the controller of this issue. It is easy to strip metadata from PDFs, for example with the exiftool utility.

equally it is possible that they are doing it so as to restrict the possible uses this data can be put to

Hanlon's razor suggests this to be unlikely: never attribute to malice that which is adequately explained by stupidity.

Also, including the third party metadata does not provide an effective deterrent. (A) The metadata can be stripped out easily from the file. (B) It is unlikely that a recipient would be aware of such metadata. There is not deterrent unless you have the knowledge that there might be embedded metadata.