responding to a SAR under GDPR?
Discussion
ICO site says:
Can we ask an individual for ID?
If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.
You need to let the individual know as soon as possible that you need more information from them to confirm their identity before responding to their request. The period for responding to the request begins when you receive the additional information.
--
Also if they are a custoemr it suggests somesort of knowledge of them anyway so if you have an email or somehting on record for them why not ask for the request to come via email.
Can we ask an individual for ID?
If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.
You need to let the individual know as soon as possible that you need more information from them to confirm their identity before responding to their request. The period for responding to the request begins when you receive the additional information.
--
Also if they are a custoemr it suggests somesort of knowledge of them anyway so if you have an email or somehting on record for them why not ask for the request to come via email.
its a wierd situation, the Subject is in dispute with one of our third party suppliers on behalf of a family member and I get the feeling they are wanting access to the correspondence between us and the third party but have submitted a SAR.
Interestingly we don't hold any data on the subject so I can't imagine a response of we aint got anything on you is going to be well received.
Interestingly we don't hold any data on the subject so I can't imagine a response of we aint got anything on you is going to be well received.
Put something in then. Be careful that in disclosing to your customer you do not include personally identifiable information on anyone else. This can require, for instance, redacting the names and email addresses of correspondents at your supplier with whom you have discussed the matter. (refer to UKDPA Sch 2 p3 16(1) for details).
Note that any emails between you and the supplier about your customer *are* part of the customer's personal data if you can identify the customer - so, for example, if you named the customer somewhere in a series of emails, all of them are part of the customer's PII. There is a small number of exclusions from the disclosure requirements of Article 15; they're also listed in Schedule 2, part 4 et seq, but they're unlikely to have any relevance to you in the normal course of trade unless you're in corporate finance or healthcare.
Note that any emails between you and the supplier about your customer *are* part of the customer's personal data if you can identify the customer - so, for example, if you named the customer somewhere in a series of emails, all of them are part of the customer's PII. There is a small number of exclusions from the disclosure requirements of Article 15; they're also listed in Schedule 2, part 4 et seq, but they're unlikely to have any relevance to you in the normal course of trade unless you're in corporate finance or healthcare.
Glasgowrob said:
Interestingly we don't hold any data on the subject so I can't imagine a response of we aint got anything on you is going to be well received.
I get lots of those. I contacted the I.C.O. about where I stand legally if I ignore all requests from people I've never heard of. It is an utter waste of time replying to morons who are fishing through sheer laziness. A Public entity has a duty to respond regardless, but it is a grey area apparently for a Private company that holds no Data on a subject who is merely fishing.
Obviously all companies have to respond if they hold any Data. But where none exists?
In the end we agreed I would set up an automated email response for SAR that informs the Subject that I will get back to them in accordance with Article 15 only if I hold any Data about them. If I do not, they are to take my non-response as evidence of this.
I have kept the Chat Transcript in my Legal's folder for future reference if needed but for now, the auto email is doing its thing and I've had no comeback yet.
Simpo Two said:
Coolbanana said:
Obviously all companies have to respond if they hold any Data. But where none exists?
What's to stop a company that does have data simply being dishonest and saying 'Sorry, we have no records, tough'?I hear that records can be deleted/destroyed after 6 years anyway.
Gassing Station | Business | Top of Page | What's New | My Stuff