Skip to main content
18 votes

Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

Spoliation of evidence, once a suit is filed The reason Bob requests the video from Alice Corp is not that he is concerned about his GDPR rights, it is because he wants to file a lawsuit. In fact, it ...
Trish's user avatar
  • 39.8k
14 votes
Accepted

Are users' personal notes about other users subjected to the GDPR right of access?

The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about ...
amon's user avatar
  • 24k
13 votes
Accepted

Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

Is it a criminal offence to destroy and conceal information [that would otherwise have to be produced in response to a SAR]? It is a criminal offence to alter, deface, block, erase, destroy or conceal ...
Lag's user avatar
  • 17.2k
12 votes

Are users' personal notes about other users subjected to the GDPR right of access?

GDPR does not apply to personal notes or processing Art. 2 GDPR (2) (c): (2) This Regulation does not apply to the processing of personal data: (c) by a natural person in the course of a purely ...
Trish's user avatar
  • 39.8k
9 votes

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

An Art 15 Subject Access Request (SAR) “shall not adversely affect the rights and freedoms of others.” It would be a grave violation of privacy for an email provider to search its users' account ...
amon's user avatar
  • 24k
8 votes

Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?

No In the first place, that “right” applies when you go to court and it isn’t the right to know them, it’s a right “to examine or have examined witnesses against him…”. And, in certain circumstances, ...
Dale M's user avatar
  • 211k
6 votes
Accepted

Are deleted comments left by U.K. based users retained and subject to subject access under U.K. GDPR?

The answers are "yes" and "yes". The first "yes" being based on my experience as a moderator: if I can still see the "deleted" comments, then obviously they ...
nvoigt's user avatar
  • 7,510
5 votes

Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

In the scenario you describe, the DPO commits an offence contrary to the Data Protection Act 2018 s.173: (3) It is an offence for a person listed in subsection (4) to alter, deface, block, erase, ...
Will's user avatar
  • 416
5 votes
Accepted

Is Cameron a data controller?

Probably The Material Scope of the GDPR is spelled out in Article 2. The videos that Cameron takes of natural persons are unequivocally personal data and his use of them counts as processing. Of the ...
Dale M's user avatar
  • 211k
4 votes

What does "reasonable and proportionate" mean wrt GDPR SAR ID requirements?

"Reasonable and proportionate" means what it says It means a proportionate response that a reasonable person would make in the circumstances. Sometimes, it may be reasonable and ...
Dale M's user avatar
  • 211k
4 votes

Why do some data controllers require two forms of ID and others only one?

Verifying the identity of the person making an SAR is a requirement (for fairly obvious reasons) but there's no specified way this is to be done. As the ICO puts it: If you’re not sure the requester ...
motosubatsu's user avatar
  • 4,670
4 votes
Accepted

Incomplete/unserviceable SAR submissions and deletion timeframes

As I understand it there is no obligation to 'triage' SARs or keep data 'just-in-case' that would otherwise be deleted as a matter of routine. Can we amend or delete data following receipt of a SAR? ...
Lag's user avatar
  • 17.2k
2 votes

Refused a subject access request

Issue a witness summons This will require you to initiate your case, presumably for defamation, first. Once you have done that, you can issue a witness summons to the school for them to produce the ...
Dale M's user avatar
  • 211k
2 votes

Access rights to professional photographs

The photograph committed a felony in germany Making photos of a person in Germany and then offering to sell it to them is considered Nötigung in Germany, which is a felony, and a violation of the ...
Trish's user avatar
  • 39.8k
2 votes

Access rights to professional photographs

australia You must be given access The organisation may charge a reasonable administration fee for this. They may impose a licence on copyrighted materials such as prohibiting use other than verifying ...
Dale M's user avatar
  • 211k
1 vote

Are data controllers required to acquire the means to appropriately redact data for disclosure to subjects?

australia One of the grounds for refusing access under the Privacy Act has “an unreasonable impact on the privacy of other individuals“ Whether giving Bob access to the footage (permanently or ...
Dale M's user avatar
  • 211k
1 vote

SARing received text messages from a lost phone

The service provider has no obligation (unless by contract) to keep the content of SMS messages. The service provider may keep content for a few hours or days, for circumstances such as unpowered ...
Lag's user avatar
  • 17.2k
1 vote

Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?

What damage has Bob suffered? Let’s assume that the company has breached privacy law. That is a necessary but not sufficient criteria for Bob to receive compensation. Bob must also have suffered ...
Dale M's user avatar
  • 211k
1 vote

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

I am not a lawyer and I am not aware of such a case being decided in court yet. So this i my interpretation of the law: Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob ...
nvoigt's user avatar
  • 7,510
1 vote
Accepted

What are good tips and tricks to keep in mind when performing a subject access request for a comprehensive record of self-pertinent data from the met?

The Information Commissioner's Office has published a webpage called "Get access to your personal data held by the criminal justice system". This seems to provide comprehensive advice about ...
Lag's user avatar
  • 17.2k

Only top scored, non community-wiki answers of a minimum length are eligible