Are users' personal notes about other users subjected to the GDPR right of access?

Question

Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable Information (PII) according to GDPR: it is linked to a specific profile of B, but also to the profile of A.

If user B wants to access to their data per GDPR, can / must you give user B the content of the notes entered by A about B?

It seems a kind of breach of privacy because before a data-access request, the information in the note was information only known to A. To me, it seems that A is responsible for the data entered, but it seems the operator of the service still has PII about B and should probably give the data to B if B asks about it.

Answer 1

The Right to Access is pretty absolute. However, there are some limitations:

• Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly?

  If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information.

  Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform.

• There is an explicit limitation to the right of access in Art 15(4):

  The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

  Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data.

  However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager.

  The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test:

  • Step one – Does the request require disclosing information that identifies another individual?
    For example, it might be possible to redact other people's information (but not in your Mastodon notes example).
  • Step two – Has the other individual provided consent?
  • Step three – Is it reasonable to disclose without consent?
    What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider.

  The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights.

In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.

Answer 2

GDPR does not apply to personal notes or processing

Art. 2 GDPR (2) (c):

(2) This Regulation does not apply to the processing of personal data:

(c) by a natural person in the course of a purely personal or household activity;

A natural person making notes for personal reasons, which those notes are, is not GDPR regulated.

The one responsible for making the notes, and the only one who can access those notes without violating contracts, is Alice. Alice is not GDPR-requestable as those are personal notes. The notes are not controlled by the company but Alice; Company is at best a Data Processor tasked by Alice to store the notes (unless those are offline on Alice's machine). Thus the notes can't be requested to be accessed as the Data Controller is Alice, not Company.

However, the company might breach its contract with Alice by accessing the notes.