GDPR - subject requests all emails

[Michelle Moore]

I have received a subject access request from someone that recently left the company asking for copies of all emails to and from that person or mentioning their name.

I am not aware of any contentious issues that might be contained within the emails. We are a very small company and I would know.

The subject still has the laptop and mobile phone provided to him for business purposes so he already has all the emails that he sent and received. Apparently he is returning the equipment when the last payroll has been completed.

Two questions...

As I have no need to keep the vast majority of the emails to, from or mentioning the subject, if I just delete them from the server and all our PC's, I'm not storing any emails containing the subjects name. It would just save someone having to print hundreds of emails. Can I respond to the request saying there are none as I have deleted them?

If someone leaves, is it OK to keep their email address for any length of time as it is their name. I could delete the email address any any incoming mail would be routed to our catch-all email if it is better to do this.

Many thanks

 

[Mike Kilby PC.dp]

Hi Michelle.

Firstly, if you delete the emails and the data subject believes the emails existed and subsequently complains to the ICO leading to an investigation, you would be expected to provide audit logs to prove they were deleted before the request was made. Particularly so if the emails exist on a device the person has, so they have evidence that they existed up until a particular date.
It is a criminal offence to delete data to avoid providing it in a Subject Access Request.

In terms of what you must provide, you are only lawfully required to provide information the data subject does not already have, so if they have emails on their laptop that they can still access, you could reasonably direct them to obtain the information from that device.
You may have to go through other employees emails such as between management or other staff regarding any disciplinary action or appraisals, even meeting minutes or notes about that person, so the person may not have all the emails pertaining to them on the device(s) they still have.

If the volume of emails is significant, you can ask the individual concerned if there are particular emails they are seeking to narrow down the search but they are not obliged to do this.


Once a person leaves the business, the email address no longer identifies that person, even if it contains there name, as they are no longer an employee. You can retain it if your business feels it is necessary and the person has no right to see anything sent to that mailbox after they left.

Hope this helps

Mike

 

[Wogan May]

This seems like a bit of a frivolous request. Since they already have all the emails to/from them, and can export/backup/print/download/whatever from their existing devices, the only thing to be gained are any emails that mention their name.

Which would be an absurd invasion of privacy and has already been identified as exempt from GDPR: https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-read-your-bosss-emails-about-you/

The main rationale there is that such a request (for ANY emails containing a mention of their name that was not addressed to them) would contain the personal information of other data subjects (namely, their thoughts), which the subject is not entitled to. Far as I understand this is a well-established precedent.

You can also reject requests if you believe they're frivolous or vexatious. In this case, since the employee already has all the information they're entitled to (their full email history) there's no good reason to ask for it again (frivolous), and if they press the point about wanting emails that merely mention them, for no good reason, that's arguably vexatious.

Obviously I'm not a lawyer, but the spirit of GDPR is not geared to support vengeful data requests like this.

 

[Mike Kilby PC.dp]

@Wogan May I would love to see the "European case law clearly states that data such as emails your boss has sent about you is exempt from this" as to my knowledge, any data including personal opinions are far from exempt from the GDPR.

The privacy element is irrelevant as any data controller should be redacting the personal data of others (unless they obtain permission from them to release the information), so that the content only identifies the data subject.

The article is quite right however that if the effort would be disproportionate, you can charge a fee. You can also ask the subject to restrict their criteria, but they are not obliged to do so.

I would not like to be the data protection officer or person in charge of data protection in an organisation who has to defend such a decision to not provide a bosses emails to the ICO. This was a specific item covered in my practitioner course and in the eyes of the ICO, they absolutely are covered by GDPR!
I'd urge you to read the ICO's post on SARS which does specifically include emails
https://ico.org.uk/your-data-matters/your-right-of-access/

Not that I am dissing anyone or any person's knowledge or qualifications, personally I am not sure I would trust as gospel information provided by a "junior associate" as traditionally this means inexperienced and/or unqualified. Essentially a trainee.

 

[Wogan May]

@Mike Kilby PC.dp I'm busy looking that up myself, actually. To date I've only considered GDPR in the context of B2C applications, where users might want to export/purge their data when cancelling a subscription. Employer/employee stuff is no doubt more complicated.

On that ICO link you shared, it does point out the following:

An organisation may refuse your subject access request if your data includes information about another individual, except where:

• the other individual has agreed to the disclosure, or
• it is reasonable to provide you with this information without the other individual’s consent.

Plus, far as I know, there have been Confidentiality rules in EU law for ages, centered on the "reasonable expectation of privacy" and GDPR wouldn't have undone that. If they did, it would open up an absolute shitstorm of frivolous requests - any disgruntled employee could make the employer's life hell with repeated requests.

So the way I understand it, if I send an email to a colleague and mention someone who later resigns, the only way they get to see what I said about them is if I consent to the disclosure, or if the information is of such a nature that automatic disclosure is warranted (civil/criminal liability?).

But it doesn't look nearly as clear cut as "everyone gets what they ask for and every case is defended to the ICO". If that were indeed the case, there would be no reason to use work email at all - everything you send could someday be requested just because you mentioned a colleague.

 

[Wogan May]

@Mike Kilby PC.dp I'm about to leave for the weekend, just wanted to link this in. From the actual text of the GDPR itself: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679

Article 15 ("Right of access by the data subject"), paragraph 3:

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

That's what enables the right to do subject access requests. Crucial, though, is paragraph 4:

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

That's where all the confusion is going to come from. GDPR can't be used to defeat privacy or get malicious access to data you're not entitled to. It can't be used to hammer a small organization with repeated access requests that require lots of resource allocation. Everything I've seen here suggests that GDPR fairly balances the rights of individuals and organizations when it comes to this stuff.

It's gonna take another couple years of cases though before we know for sure where we stand, though!

 

[Newchodge]

Obviously I'm not a lawyer

Very obviously if you give rubbish advice like this. The data subject is entitled to receive all personal information held about them. Discussions about the individual that take plave without their knowledge are NOT exempt.

 

[Mike Kilby PC.dp]

Let me try to make this as simple as possible;

1. If it is a company supplied system, any data held within it is subject to the GDPR if it identifies or relates to an individual living person, regardless of who wrote it or why.
2. You are lawfully bound by Article 15 to supply everything, no exceptions, but;
   
3. If data can identify another person (paragraph 4), you must redact it so that it does not identify that person, if you cannot get the permission of the person to release the information unredacted.

Check out the recitals that go along with Article 15 at https://gdpr-info.eu/recitals/no-63/
Particularly point 6 "However, the result of those considerations should not be a refusal to provide all information to the data subject"

The supply of such information was part of the Data Protection Act 1998, the only reason people are now worried about it is because they know about it. The vast majority of businesses barely understood their DPA obligations and the GDPR has just "woken them up".

Also, when looking at Data Protection in the workplace, don't forget to consider the hidden gem, the Data Protection Act 2018 which adds more conditions over the GDPR, such as all employment references now being exempt from Subject Access.

 

[Wogan May]

Particularly point 6 "However, the result of those considerations should not be a refusal to provide all information to the data subject"

Which is directly preceded by point 5, which says:

That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software.

That's the point I keep coming back to. If the result of a subject access request is that somebody else's privacy is infringed, then it's an adverse affect. I agree 100% with you on the point that irrelevant information would need to be redacted and that there could be a huge time/money cost associated to that, but in no way does GDPR allow an ex-employee to infringe the privacy of their former employer through a simple request.

If the answer is in fact point 6, like you said, that every request results in all information being provided, then there is no point to item 5, or to privacy in general. That's what I can't reconcile here: How could GDPR uphold privacy while also providing a mechanism to completely subvert that?

 

[Wogan May]

Very obviously if you give rubbish advice like this. The data subject is entitled to receive all personal information held about them.

I've just spent the last hour reading ICO guidance on this, and it's not "rubbish" to point out that there is a lot of context that needs to be considered on a request like this. It's not just a straight "if email contains word 'Cyndy' then export" request - every single item needs to be considered in terms of the right to privacy that other affected subjects have.

This is how complicated it can get (one of the examples):

Emails written by a lawyer to their client about their client’s matter all contain references to the lawyer’s name and place of work, which will be the lawyer’s personal data. However, the content of the emails are not about the individual lawyer, but about the client’s instructions. The content of the email is not, therefore, personal data where it concerns legal advice about the client’s legal query.

If a complaint was then made about the lawyer’s performance or advice and the emails were then used to investigate this, the legal advice given in them would become personal data.

Link: https://ico.org.uk/for-organisation...sonal-data/what-is-the-meaning-of-relates-to/

More to the point - the simple question of "what is personal data" goes on forever, including gems like:

• Information must ‘relate to’ the identifiable individual to be personal data.
• This means that it does more than simply identifying them – it must concern the individual in some way.
• To decide whether or not data relates to an individual, you may need to consider:
  • the content of the data – is it directly about the individual or their activities?;
  • the purpose you will process the data for; and
  • the results of or effects on the individual from processing the data.
• Data can reference an identifiable individual and not be personal data about that individual, as the information does not relate to them.

Link: https://ico.org.uk/for-organisation...n-gdpr/key-definitions/what-is-personal-data/

Finally, if I were any sort of actual lawyer I'd be charging for this. Clearly forum posts are not legal advice.

 

[Mike Kilby PC.dp]

I've just spent the last hour reading ICO guidance on this, and it's not "rubbish" to point out that there is a lot of context that needs to be considered on a request like this. It's not just a straight "if email contains word 'Cyndy' then export" request - every single item needs to be considered in terms of the right to privacy that other affected subjects have

Indeed, There is far more to the entire data protection subject that simply reading a single paragraph of legislation out of context, or googling it and finding just one interpretation, which is not always the correct interpretation.

if I were any sort of actual lawyer I'd be charging for this. Clearly forum posts are not legal advice.

I do charge, but I also feel that those who cannot afford to engage a professional shouldn't be left out, hence why I participate in forums like this.

Forum posts are most definitely not and will never replace proper legal advice. Where I can offer an opinion, I will, but I would always recommend that anyone who is in any doubt, consults with someone like myself in a professional capacity, or a relevant legal professional like @Newchodge who are specialists in their own respective area, and can perhaps understand the intricacies of legislation specific to their market better than I can.

 

[paulears]

A side question. In the case of emails - if I'm understanding this correctly, I have a right to read anyone else's email that mentions me? Is this correct? Sounds like a real invasion of privacy? How would anyone involved in say, disciplinary cases, keep their defence or attack details private? Surely the content of emails is like letters and printed material, private? It's not data is it? It's plain language text - does that count as data? This also seems to mean that an employer would have to read employees emails - something also quite tricky to justify.

 

[Mike Kilby PC.dp]

You have a right to make a subject access request to your employer to see any information held that is about you.

It is not an invasion of privacy because your employer would have to redact the personal information of any other individuals referenced in the emails.

In the case of disciplinaries or similar, an employer can refuse in grounds that “provision would prejudice formal proceedings” however a tribunal or court could overrule this.

There is no such thing as private in the context of an employer/ employer relationship. If it’s private it’s personal and should not be done in company systems or in company time.

Ther defininittion of personal data is “any data both written or electronic which alone, or in combination with other data you may have, or could reasonably obtain in the future, identifies or related to and identified individual living person”

There is a rider that it must be in a structured filing system, so anything that is organised by some attribute (such as email address) or searchable easily (like emails) is data under the law.

I am sure that most employers now should have IT policies which should state that they may be monitored, er go can be read.

I can’t remember off the top of my head, but I am sure there is an ICO enforcement action against a company for not supplying emails as part of a SAR when they could have reasonably done so.

 

[Alan]

It is not an invasion of privacy because your employer would have to redact the personal information of any other individuals referenced in the emails.

I think this is the key point, the employee could see the email, but the sender & receivers would be deleted and all text not relevant to them would be deleted.

So they may get
From: *****
To: *****
************
******** ********** by the way Fred Jones isn't pulling his weight maybe put him under review ******** ********** ************

From: *******
To *******
*********** ***************** ******* * by the way just start disciplinary process on Fred Jones ****** ******* ********

Obviously this will involve a lot of manual review .............

 

[ecommerce84]

That was how I would interpret it too Alan.

It does seem like a lot of hard work for nothing given that Michelle Moores ex employee is only requesting these emails to be awkward and bloody minded.

 

[Mike Kilby PC.dp]

That is the correct interpretation Alan.

ecommence84, yes it might be a lot of hard work, but I don't believe Michelle ever said that this was someone being awkward or bloody minded.

She is not aware of any issues, which she believes she would be, but the person may have other reasons for wanting them.

The employee might feel that they were unfairly dismissed, or felt like they had no choice but to leave. They might have been asking for a pay rise and not got one. We simply don't know the circumstances of the employee's departure, so it's not really productive to draw conclusions based on the lack of knowledge.

All we can do is inform Michelle of what the correct legal interpretation of the GDPR is in her scenario.

 

[obscure]

This means that it does more than simply identifying them – it must concern the individual in some way.

So an email sent to or from someone isn't personal information relating to them just because it was addressed to them/sent by them, say if it is about an order shipped from China and they were receiving it to make them aware. In other words they have no right to request all emails sent/received only those where they were in part the subject of the email.

 

[Wogan May]

Somewhat tangential: Email is a mess.

Not only would a SAR require lots of redaction, but the way people use email itself is inefficient. People start threads that build up enormous reply, forward, reply-all, cc, and bcc chains, each message containing the entire history of that thread of the conversation.

Content that needs to be redacted from the first email in the thread would also need to be redacted in all messages that contain the initial content - you'll be removing the same references from hundreds of messages at a go.

Honestly, this is all a fantastic argument for not using email at all, and rather using an internal group chat tool like Slack for business communication.

 

[Mike Kilby PC.dp]

So an email sent to or from someone isn't personal information relating to them just because it was addressed to them/sent by them

@obscure an email identifies at least two individual people, the person who sent it and the person who received it, so it is personal data.
If the employee was fired because the delivery was late, they may want to take the matter to a tribunal and obtain copies of those emails to prove that they placed the order in good time and it was not their fault.

Honestly, this is all a fantastic argument for not using email at all, and rather using an internal group chat tool like Slack for business communication.

@Wogan May unfortunately if internal group chat is used, this is also personal data because they generally identify who is sending a message. I have actually had a case of a client with an employee who was being frankly obnoxious via Skype for Business with another employee. The complaint made an SAR to request the chat logs to demonstrate inappropriate advances towards them at a tribunal.

Even things like this forum are personal data. My replies here are my opinions or views, as are yours. In theory, any one os us could make an SAR to UK Business Forums and expect them to pull out of their system, every post we ever made, of course redacting any other identifiers of other people.

As I have said before, these are nothing new, we've had this in the Data Protection Act 1998, it's just that people are now more aware of it through the hype that was generated over GDPR.
The only data that is exempt from GDPR is data that is purely your personal affairs.

 

[Alan]

Even things like this forum are personal data. My replies here are my opinions or views, as are yours. In theory, any one os us could make an SAR to UK Business Forums and expect them to pull out of their system, every post we ever made, of course redacting any other identifiers of other people.

Minor point - I think that would only apply to private messages - as the public posts are - well - public - so you already have access.

But I guess you are saying that I could ask UKBF to give me all private messages where I have been mentioned by other forum members privately, perhaps taking the rise out of my dyslexic responses or lack of understanding of split infinitives ... what fun ... but perhaps that is frivolous and thus chargeable ?

 

[Mike Kilby PC.dp]

Well, they could feasibly refuse such a request for that very reason. The fundamental principle is the same though.
They will still be bound to comply with the GDPR because it’s personal data.

 

[Newchodge]

Minor point - I think that would only apply to private messages - as the public posts are - well - public - so you already have access.

But I guess you are saying that I could ask UKBF to give me all private messages where I have been mentioned by other forum members privately, perhaps taking the rise out of my dyslexic responses or lack of understanding of split infinitives ... what fun ... but perhaps that is frivolous and thus chargeable ?

You have access to all public posts, but can you find every post in which you are mentioned?

 

[Alan]

You have access to all public posts, but can you find every post in which you are mentioned?

Yes - the search tool. And if I can't how could it be expected UKBF can?

 

[tony84]

Does the person want everything in paper format or electronic?
IF you choose to send the emails, I think I would be looking at charging them as their could be thousands of emails.
If paper, I would be charging them - someone has to sit there and print everything off.
If electronic I would probably still charge as someone has to go through the emails and check what information is included on them...

https://ico.org.uk/for-organisation...ation-gdpr/individual-rights/right-of-access/

I would certainly not be telling them to take a copy from their work laptop.

What should we do if the data includes information about other people?
Responding to a subject access request may involve providing information that relates both to the individual making the request and to another individual.

The DPA 2018 says that you do not have to comply with the request if it would mean disclosing information about another individual who can be identified from that information, except if:

• the other individual has consented to the disclosure; or
• it is reasonable to comply with the request without that individual’s consent.

In determining whether it is reasonable to disclose the information, you must take into account all of the relevant circumstances, including:

• the type of information that you would disclose;
• any duty of confidentiality you owe to the other individual;
• any steps you have taken to seek consent from the other individual;
• whether the other individual is capable of giving consent; and
• any express refusal of consent by the other individual.

So, although you may sometimes be able to disclose information relating to a third party, you need to decide whether it is appropriate to do so in each case. This decision will involve balancing the data subject’s right of access against the other individual’s rights. If the other person consents to you disclosing the information about them, then it would be unreasonable not to do so. However, if there is no such consent, you must decide whether to disclose the information anyway.

For the avoidance of doubt, you cannot refuse to provide access to personal data about an individual simply because you obtained that data from a third party. The rules about third party data apply only to personal data which includes both information about the individual who is the subject of the request and information about someone else.

Could you not argue that if an email is from another person and expresses their opinion they can argue they do not give consent and so it can not be provided?

Have you actually read up on the GDPR ICO page?

What is an individual entitled to?
Individuals have the right to obtain the following from you:

• confirmation that you are processing their personal data;
• a copy of their personal data; and
• other supplementary information – this largely corresponds to the information that you should provide in a privacy notice (see ‘Other information’ below).

Personal data of the individual
An individual is only entitled to their own personal data, and not to information relating to other people (unless the information is also about them or they are acting on behalf of someone). Therefore, it is important that you establish whether the information requested falls within the definition of personal data. For further information about the definition of personal data please see our guidance on what is personal data.

How are work emails personal data?

I would speak to the ICO first, but I would be arguing work emails are work related and not information you hold on the individual.

Also, why do they actually want these emails? I think that is important to understand as it may help you narrow down their request to something which is manageable.

 

[Wogan May]

@Wogan May unfortunately if internal group chat is used, this is also personal data because they generally identify who is sending a message

Oh for sure - I was suggesting it for precisely that reason: Identifying anything sent to/about a person would be much faster than email, as would the necessary redactions. Centralized chat systems keep the logs in one place, and make dumping and e-discovery trivial (specially Skype for Business).

It's emails I wouldn't want to comb through, with all the reply-alls, massive threads and duplication

 

[Wogan May]

How are work emails personal data?

Because you can identify people from the contents inside them. Email signatures make it obvious, contextual conversations too ("the head of HR" sent on a particular date etc).

In this context, "work" and "personal" don't have the same clear line of separation that they had before.

 

[tony84]

The content of the emails are (presumably) work related and not personal information.
Does that mean then you can send a list of dates/times emails were sent/received and who to/from if the person who sent/received the email explicitly agrees to it?

If that is the case, I would just say you sent and received emails. The personal data contained in those emails were your name (as the phone number/email address and company assets?).

I would speak to the ICO as I think it is a ridiculous request and providing everything requested would put you in breach of Data protection and potentially GDPR laws.

My thoughts are that I would be writing a letter explaining what can be provided (ie dates and times of emails sent containing their personal information - ie their name) and that you will not be providing the contents of those emails as they do not contain personal information and ask if they would like that information. I would also look to charge for it as it will take hours to list the date and time of every email sent - unless you have a way of automating it

But as mentioned, I would speak to the ICO and get their thoughts on it first.

 

[Wogan May]

I would speak to the ICO as I think it is a ridiculous request and providing everything requested would put you in breach of Data protection and potentially GDPR laws.

This is the problem, and the ICO's guidance makes it clear that a lot of it is contextual, requiring an awful lot of judgement calls. The GDPR itself requires that the disclosure of info for a SAR doesn't infringe on the rights of other data subjects - including the right to privacy.

 

[tony84]

This seems to say otherwise, although the argument is what is reasonable.

The DPA 2018 says that you do not have to comply with the request if it would mean disclosing information about another individual who can be identified from that information, except if:

• the other individual has consented to the disclosure; or
• it is reasonable to comply with the request without that individual’s consent.

Personally I think you are being a bit ridiculous if you think hundreds or thousands of emails with potentially other confidential information needs sorting through because an email contains the persons name in the email address or signature.

I suppose it is a little different if the persons full name is in the subject or body of the email but that would probably reduce the number of emails down significantly. If there were more than say 50-100 emails, I would be looking to charge to go through them and redact any confidential information.

 

[KM-Tiger]

I suppose it is a little different if the persons full name is in the subject or body of the email but that would probably reduce the number of emails down significantly. If there were more than say 50-100 emails, I would be looking to charge to go through them and redact any confidential information.

Speaking as an email systems administrator the task described would be considerable and not without difficulties, and thus potentially very expensive.

If the subject name is John Doe, for instance, then easy enough to search for all instances of that name, but what if the company has 3 Johns? Only an understanding of context could be used to determine if the John referred to was indeed John Doe and not someone else.

 

[tony84]

Good point. Although in this case as the OP seems to be a small business, I doubt there will be 2 or 3 people with the same name.

 

[Wogan May]

Personally I think you are being a bit ridiculous if you think hundreds or thousands of emails with potentially other confidential information needs sorting through because an email contains the persons name in the email address or signature.

That would be ridiculous, yes: Specially since the person in question was either the originator or intended recipient of the message (if it's their signature or email address respectively), meaning that the data has already been disclosed to them, and a SAR wouldn't get them anything they don't already have.

I suppose it is a little different if the persons full name is in the subject or body of the email but that would probably reduce the number of emails down significantly.

And that's where it gets complicated. Emails from Alice to Bob about Sue, in which Sue is never addressed directly yet is mentioned in an identifiable way could potentially constitute personal data about Sue and would be subject to disclosure. At least that's the way I understand it, and @Mike Kilby PC.dp has alluded to the same (I think?)

 

[Michelle Moore]

Firstly, thank you all so much for your detailed responses to my question - it is much appreciated. I've read through everything now and I just wanted to clarify a few points.

I have waffled a lot so I've made the actual questons bold.

The subject was not fired, he gave notice and we accepted it.

He had been with the business less than six months and there had been lots of difficulties but I would prefer not to go into detail. Suffice to say there were issues that, had we known about them beforehand, would have informed our decision to offer him the post.

None of this was discussed in emails, written down or stored or processed in any way. We had a few private discussions where it all came out but we didn't make notes for the HR file (probably should have).

Everyone has looked through their emails and there are literally four that mention the subject by name in terms of "speak to our FirstName LastName, he will arrange for you" or words to that effect.

Nobody is going to refuse permission for me to send copies of these emails to him.

Clearly, the subject is making this request for malicious purposes but I'm trying to just deal with it as there isn't a huge amount of data. The only real issue is having to print off all the emails and redact other individuals info. There is literally nothing in any of these emails to get excited about. I was copied in on practially every email he either sent or received as his line manager and there is nothing. I honestly can't see any reason for wanting them other than to be a nuisance. They don't prove or disprove anything.

As I said, we didn't sack him, it was his decision to leave.

I had already identified the personal data that we hold on staff and it is as follows:

• HMRC records in our payroll programme and copies of payslips that he will already have
  
• Driving licence, convictions etc for use of company vehicle
  
• Training certificates
• Application forms to training course providers
• Bank details in online banking - we would normally delete these as soon as someone leaves
• Copies of competence cards for working on site

We are a construction company, we just don't generate loads of documents identifying individuals. There is nothing we have that anyone here would expect me to redact - we are just not that interesting.

We knew this person via another business and he approached us for a job so we don't have his CV, we didn't apply for references and we didn't add him to our company website as an employee. We didn't have any discussions (good or bad) about remuneration or benefits. There were no warnings given or apprisals as he was only here for five months. I have a template for his business card but the cards have been shredded. He can have copies of everything we have; I'm not trying to avoid it.

Regarding the laptop, he won't return it. I can access his email account on an Exchange server so I could potentially print everything off but as he has it already, why would I need to do that?

Regarding the redaction, what about external individuals? There is an email from a client advising us that the subject was not welcome back on their site. The email doesn't say why (I know why) and I am happy to send him a copy of it (as you can imagine!) but I presume I have to redact all the client individual names?

I haven't asked the client for their permission but I can and I'll get an answer straight away.

Do I have to redact the company name as well? Presumably not? Even if I redact the individuals names, the whole email makes it perfectly plain who wrote it so can I withold that one completely if I don't get permission?

He has asked for copies of emails going back to January when we started discussing his potential job here. These were all to and from his personal account. Having read all your responses, it sounds like I don't have to bother with these as he wasn't an employee then. Is this correct?

Thank you all again for the time you spent replying to my original question.

 

[Newchodge]

These were all to and from his personal account. Having read all your responses, it sounds like I don't have to bother with these as he wasn't an employee then. Is this correct?

I don't think so. The right is for the individual. not the employee.

With regard to the laptop, either tell him to return it or he will be reported for theft or sue him for the value. (I know you haven't asked for advice about this, sorry to be intrusive).

 

[tony84]

Regarding the laptop, he won't return it. I can access his email account on an Exchange server so I could potentially print everything off but as he has it already, why would I need to do that? - Send a letter before action requestion it be returned in 14 days or you will be forced to go down small claims court for the cost of the laptop. If you can, I would remove his access to files/documents and emails. This should really have been done the day he left.

Regarding the redaction, what about external individuals? There is an email from a client advising us that the subject was not welcome back on their site. The email doesn't say why (I know why) and I am happy to send him a copy of it (as you can imagine!) but I presume I have to redact all the client individual names? - Definitely.
.

I haven't asked the client for their permission but I can and I'll get an answer straight away.

Do I have to redact the company name as well? Presumably not? Even if I redact the individuals names, the whole email makes it perfectly plain who wrote it so can I withold that one completely if I don't get permission? - I do not know the answer to this. I would ring the ICO.

He has asked for copies of emails going back to January when we started discussing his potential job here. These were all to and from his personal account. Having read all your responses, it sounds like I don't have to bother with these as he wasn't an employee then. Is this correct? I do not know the answer to this either, but for what it is, I would probably do it.

Dont bother printing them out, attach them to an email and email to him - if you can password protect them, even better with a different password for each one - something like a£r56GvP for each just to really P him off.

 

[Blaby Loyal]

Dont bother printing them out, attach them to an email and email to him - if you can password protect them, even better with a different password for each one - something like a£r56GvP for each just to really P him off.

I like that way of thinking - lovely stuff.

 

[Michelle Moore]

OK so if it is about the individual and I have to provide copies of all the emails prior to him becoming an employee, why are emails after he left not also relevant? Is it because his comapny email no longer identifies him (someone said this up thread) and his personal one does?

I have removed access to the email server and any company data and changed the password on the email account but he has the laptop where the emails are downloaded locally from the Exchange server. That's why he can still see all of them. He can't send any new ones but he can print off the existing ones or save them to a folder or whatever in Outlook.

Redacting the client thing is easy - it's one email and a quick telephone call either for permission or to confirm that I will provide a copy and black out any personal details or company info. I will call the ICo about this though because it is completely obvious who wrote it.

 

[cjd]

As far as I'm aware, he has no right to emails generated in the normal course of business about normal business matters; those are commercially confidential matters that belong to the company. It's not personal data. A call to the ICO should sort this out for you.

 

[Soundfaction]

We had a couple of requests and had to extract all the email as pst files from Exchange and then redact all sensitive information before sending to the requester. It was quite a process but it helped finding a suitable software tool to carry out the grunt work of the redaction. I have heard of larger companies paying employees to do this, and it taking a week for each request, and costing the company over £500!

We used Powershell to extract all likely email from Exchange and then Hexamail Flow to do the redactions.

 

[Victoria Barton]

I have received a subject access request from someone that recently left the company asking for copies of all emails to and from that person or mentioning their name.

I am not aware of any contentious issues that might be contained within the emails. We are a very small company and I would know.

The subject still has the laptop and mobile phone provided to him for business purposes so he already has all the emails that he sent and received. Apparently he is returning the equipment when the last payroll has been completed.

Two questions...

As I have no need to keep the vast majority of the emails to, from or mentioning the subject, if I just delete them from the server and all our PC's, I'm not storing any emails containing the subjects name. It would just save someone having to print hundreds of emails. Can I respond to the request saying there are none as I have deleted them?

If someone leaves, is it OK to keep their email address for any length of time as it is their name. I could delete the email address any any incoming mail would be routed to our catch-all email if it is better to do this.

Many thanks

Dear Michael,

I have read your questions relating to the subject access request and this is something I can align strongly with as a small company also dealing with SAR's.

The guidance for small businesses is lacking, the time it takes to complete them can be lengthy and there are financial implications involved with responding to them.

I understand and agree that individuals must have a right to their own data, however, there needs to be more support for businesses when doing so. It seems that SAR's are primarily being used as a means of retribution by former employees rather than being used for the purpose in which they were designed. I have created a petition and if you agree with the cause I would be grateful if you would sign and share with other business owners in similar positions.

As I am a new member to this forum it will not allow me to post links but it can be found on change. org with the following reference FhVvZkgN

Kind regards,
Victoria