By clicking “Accept All”, you agree to the storing of cookies on your device to enhance site navigation, analyse site usage, and assist in our marketing efforts
Essential
These cookies enable our website and App to remember things such as your region or country, language, accessibility options and your preferences and settings.
Analytics
Analytic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.
Marketing
Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.
That would be ridiculous, yes: Specially since the person in question was either the originator or intended recipient of the message (if it's their signature or email address respectively), meaning that the data has already been disclosed to them, and a SAR wouldn't get them anything they don't...
This is the problem, and the ICO's guidance makes it clear that a lot of it is contextual, requiring an awful lot of judgement calls. The GDPR itself requires that the disclosure of info for a SAR doesn't infringe on the rights of other data subjects - including the right to privacy.
Because you can identify people from the contents inside them. Email signatures make it obvious, contextual conversations too ("the head of HR" sent on a particular date etc).
In this context, "work" and "personal" don't have the same clear line of separation that they had before.
Oh for sure - I was suggesting it for precisely that reason: Identifying anything sent to/about a person would be much faster than email, as would the necessary redactions. Centralized chat systems keep the logs in one place, and make dumping and e-discovery trivial (specially Skype for...
This is the whole thing.
I spent a decent amount of time working with at-risk people, the mentally ill, and the homeless. Among other things, I've learned not to care about the opinions of people that proclaim sympathy for the homeless but wouldn't let one into their homes.
The reality is...
No, that's based on talking to actual homeless people. Most of the ones I've met are either incapable or unwilling to accept responsibility for their circumstances. That's distinct from the temporarily-homeless, which is an equally tragic situation that people can and do work themselves out of...
Somewhat tangential: Email is a mess.
Not only would a SAR require lots of redaction, but the way people use email itself is inefficient. People start threads that build up enormous reply, forward, reply-all, cc, and bcc chains, each message containing the entire history of that thread of the...
It seems that subscription vs perpetual licensing is one of those holy wars that there are no satisfactory objective answers to, which is fine. There's just one point to consider with perpetually-licensed products: If you're not receiving perpetual security updates for as long as you use the...
That's a tough one. While the USD->GBP rate will probably be impacted by Brexit (maybe not as much as you might think, with people likely having priced a lot of outcomes in already), chances are the USD->Everything rate is going to be impacted a lot more by the ongoing trade war. There may not...
I've just spent the last hour reading ICO guidance on this, and it's not "rubbish" to point out that there is a lot of context that needs to be considered on a request like this. It's not just a straight "if email contains word 'Cyndy' then export" request - every single item needs to be...
Which is directly preceded by point 5, which says:
That's the point I keep coming back to. If the result of a subject access request is that somebody else's privacy is infringed, then it's an adverse affect. I agree 100% with you on the point that irrelevant information would need to be...
@Mike Kilby PC.dp I'm about to leave for the weekend, just wanted to link this in. From the actual text of the GDPR itself: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679
Article 15 ("Right of access by the data subject"), paragraph 3:
That's what enables the right to...
@Mike Kilby PC.dp I'm busy looking that up myself, actually. To date I've only considered GDPR in the context of B2C applications, where users might want to export/purge their data when cancelling a subscription. Employer/employee stuff is no doubt more complicated.
On that ICO link you shared...