Skip to main content

Questions tagged [subject-access-request]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer

What does "reasonable and proportionate" mean wrt GDPR SAR ID requirements?

When one makes a GDPR Subject Access Request (SAR) the data controller should confirm that the request is really coming from the data subject. From here Recital 64 of GDPR states; “The controller ...
1 vote
1 answer

Are data controllers required to acquire the means to appropriately redact data for disclosure to subjects?

Bob appears in CCTV footage that is held by all of ACME, BCME & CCME, but also features Alice and Charles. He requests access to the footage from all of the companies and receives three different ...
1 vote
1 answer

Is Cameron a data controller?

Cameron doesn’t take greatly thoughtful pains in defining himself with respect to his street and online activities. Some may consider him a political activist, some a citizen and/or amateur journalist,...
-2 votes
1 answer

Are deleted comments left by U.K. based users retained and subject to subject access under U.K. GDPR?

Meet Bob; Bob left some comments on a post on stack exchange and some over zealous moderators decided that they were not needed and so to delete them. Bob wishes to access these comments for the ...
-4 votes
1 answer

Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?

Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
1 vote
1 answer

SARing received text messages from a lost phone

Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received. Bob loses his phone but ...
-3 votes
1 answer

Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?

Bob requests data from ACME. They ask him for identification according to very unreasonable and onerous requirements. He objects to these on grounds of infeasibility and inaccessibility. They bicker ...
6 votes
2 answers

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
0 votes
0 answers

What is the legality and consequence of blocking one who submits a SAR? [duplicate]

Alice submits a subject access request to Bob via WhatsApp, Bob responds to this by blocking Alice, but otherwise ignores her. What is the legality and consequences of Bob’s response to her SAR?
3 votes
2 answers

Access rights to professional photographs

An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these ...
-1 votes
1 answer

SAR before claim: tactical and legal considerations [closed]

A claimant C intends to sue a business B, which is also a data controller. Independently of the prospect of any civil action, C is entitled to make a SAR (Subject Access Request) to B under the Data ...
11 votes
2 answers

Are users' personal notes about other users subjected to the GDPR right of access?

Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable ...
-2 votes
1 answer

Why do some data controllers require two forms of ID and others only one?

Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces. Some police forces simply require scan of id with ...
1 vote
1 answer

Incomplete/unserviceable SAR submissions and deletion timeframes

Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification ...
2 votes
1 answer

How can data received in online subject access request form be used by ACRO?

Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office under the Data Protection Act. Their online request form solicits much intrusive information. What purposes may information ...
10 votes
3 answers

Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store. Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head ...
3 votes
1 answer

Refused a subject access request [closed]

A person has made an email allegation to my daughters school that I have been emotionally abusing my daughter. The school have decided not to take this any further due to the fact they believe its ...
-1 votes
1 answer

What are good tips and tricks to keep in mind when performing a subject access request for a comprehensive record of self-pertinent data from the met? [closed]

Bob would like to obtain as comprehensive as possible am archive of all data held on him by the metropolitan police, as well as any other police networks that they may be part of and share data with/...
-1 votes
1 answer

Can a person make a subject access request for police body cam footage?

A British Transport Police officer accused a subject of wasting police time after the subject waited patiently for police attendance to resolve a situation with a counterpart who had called police. ...