Hi everyone,
We are also dealing with a SAR from a current employee, who has asked for copies of the emails containing their personal data between a list of specific staff. We came to the same conclusion that a few others in this discussion have, namely that they are only entitled to the personal data held in the emails, and not the remaining information.
In our case there are two HR employees included, and in light of the fact that they are acting in a professional capacity advising on employment matters relating to the individual, we considered whether it might be reasonable to include their details, but on balance we felt it might be better to have a consistent approach to all emails.
We were also mindful that a particular turn of phrase, regular spelling mistake, or style of writing in general may be enough to identify an individual, so it would not be enough to redact the obvious personal data. (I am a good example of this, since I am an overuser of exclamation marks, so if someone took emails which included some from me, I may well be identifiable!!!).
The ICO website guidance for individuals is not particularly helpful in this respect, since my colleague spotted that they actually advise individuals that they can ask for " emails between 'person A' and 'person B'" but does not make it clear that they may not get the actual email.
My colleague is handling the request and has undertaken a central search of the email system, which has so far turned up 3,000+ emails covering the criteria given. This will hopefully reduce after a bit of filtering, but will still be a large number. We will be considering whether we can apply the extra time extension on the grounds of complexity, but this will depend on the results of the filtering.
Best wishes,
Michelle
Michelle Brown
Information Manager
Transport for Greater Manchester
2 Picadilly Place, Manchester M1 3BG
Direct live: 0161 244 1123, Extension 701123
www.tfgm.com
Please do not print this email unless you really need to.
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Speirs, Seth
Sent: 06 June 2019 11:39
To: [log in to unmask]
Subject: [data-protection] FW: [data-protection] SAR Former employee emails
-----Original Message-----
From: Speirs, Seth
Sent: 06 June 2019 11:40
To: 'Richard Thorne (Computer Services Manager)'
Subject: RE: [data-protection] SAR Former employee emails
" but importantly not the context of who the emails were between. The exception to this obviously being when they could work this out for themselves by limiting their request to content in emails to or from certain individuals only. I was also reminded of the need to redact any content that refers to other individuals (sender/recipient, etc.) unless we have their consent."
This approach does seem unnecessarily pointless and time consuming (and contrary to the spirit of the legislation), particularly as you point out the data subject can just ask for emails relating to a particular third party anyway and get the data anyway.
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Richard Thorne (Computer Services Manager)
Sent: 06 June 2019 11:28
To: [log in to unmask]
Subject: Re: [data-protection] SAR Former employee emails
It's interesting that the ICO cannot seem to be consistent in their advice. What you were told Tony, is almost the opposite of what they told me when I spoke to them last week (apart from that every case has to be taken on its own merit).
I was advised that a SAR for email would only entitle an individual to be given the content that contains their personal information, but importantly not the context of who the emails were between. The exception to this obviously being when they could work this out for themselves by limiting their request to content in emails to or from certain individuals only. I was also reminded of the need to redact any content that refers to other individuals (sender/recipient, etc.) unless we have their consent.
In fairness, this approach sounds sensible to me, but at the moment, I can't think of any way of achieving this without an incredible amount of manual effort. Anyone have any recommendations/advice?
Regards
Richard J. Thorne, FBCS, CITP, CDCM, RITTech
Rheolwr Gwasanaethau Cyfrifiadurol / Computer Services Manager Coleg Gŵyr Abertawe / Gower College Swansea
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Tony Sheppard
Sent: 06 June 2019 11:10
To: [log in to unmask]
Subject: Re: [data-protection] SAR Former employee emails
I raised this with ICO helpline again yesterday and, not surprisingly, they repeated that every case had to be taken on its own merit ... but that even if data was provided, the document (e.g. the email) has context that might be deemed required, e.g. it is not just what was in the email but who was involved and the time/date.
At that point ... you just say ... heck, that means we share the email!
This is one reason I am trying to get folk to understand that emails should not be used for records, make sure you record things in the right place and then get rid of what you don't need!
Tony Sheppard
-----Original Message-----
From: This list is for those interested in Data Protection issues <[log in to unmask]> On Behalf Of Palmer-Dunk, Dan
Sent: 06 June 2019 10:32
To: [log in to unmask]
Subject: Re: [data-protection] SAR Former employee emails
I think you're right to take that approach - as Phil has stressed elsewhere, A15 entitles access to data, not documents. You cannot provide access to the entire archive without risking adversely affecting the rights and freedoms of others (A15(4)).
Dan
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Liam Wilkinson
Sent: 06 June 2019 10:27
To: [log in to unmask]
Subject: [data-protection] SAR Former employee emails
Hi all,
Just looking for a sense check here. We have received a request from the union representative of a former employee for emails from the former employee's work email account. It reads:
"we request that steps are put in place to archive the content so that it can be supplied to XXX and [their] representatives to enable the search and retrieval of pertinent emails".
The former employee's email account is suspended, not closed. My thinking is that the request for the entire email archive is excessive and the archive will, of course, contain other people's personal data. I would suggest that we ask the requester to be more specific about the data required (email content/emails within a certain time frame etc) and then we can provide a specified selection of emails, redacted where required.
Any suggestions/comments would be much appreciated. SARs are few and far between here!
Thanks,
Liam
YSJU
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=UbHjQUlbEE88PFIJ4g1fh4EW6BaIaam090dXYq_uMaBnDFHBSHo1AfL43XZhCFH3y5lBO_X1UTzyDKknu4q7yIk33MXADa5Ioq8F9oBtHSgGfTeURvi91nFWY4XYV8bkzIL63Dqzoj6m3t-4Y5tAqkmY0uWPe3O9Jeej2Qe9ALlBkHNy8IO-zSZeBZayT-T9HYk1kpxZ7WKFX2Ah0LvlvQfNyX5iER47KKSK0DU6-Uq-WjSx0ogBq6k59DFvRxh8
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=Y5-VekkmtKfh5PHDICQLzuoP4IovA8duWyJIw6PqTjlznRuSMuexhqke9xTIX0kUnvfTCOAKfcJrZg5_i9gcAra2CaXx41sB1yDhGpcZnK-S5P_LwQYaIAmM42XQ00j4d-2t85EAjQrP9t6MehSbgwJXkK97Z_miiY9TPN5LtAM5oVynkJGXMso46rLnyI3JP_IZqmXJjc-Pv9FiO8ufuMImPQ1BUaUzQhbmPCCYFO30uJRyXA7_e9xs0kA3qlGi95GE9yvK2gZHws4-hCpmaQ
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
________________________________________________________________________
The information in this email (and any attachment) may be for the intended recipient only. If you know you are not the intended recipient, please do not use or disclose the information in any way and please delete this email (and any attachment) from your system.
The Council does not accept service of legal documents by e-mail.
________________________________________________________________________
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=UbHjQUlbEE88PFIJ4g1fh4EW6BaIaam090dXYq_uMaBnDFHBSHo1AfL43XZhCFH3y5lBO_X1UTzyDKknu4q7yIk33MXADa5Ioq8F9oBtHSgGfTeURvi91nFWY4XYV8bkzIL63Dqzoj6m3t-4Y5tAqkmY0uWPe3O9Jeej2Qe9ALlBkHNy8IO-zSZeBZayT-T9HYk1kpxZ7WKFX2Ah0LvlvQfNyX5iER47KKSK0DU6-Uq-WjSx0ogBq6k59DFvRxh8
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=Y5-VekkmtKfh5PHDICQLzuoP4IovA8duWyJIw6PqTjlznRuSMuexhqke9xTIX0kUnvfTCOAKfcJrZg5_i9gcAra2CaXx41sB1yDhGpcZnK-S5P_LwQYaIAmM42XQ00j4d-2t85EAjQrP9t6MehSbgwJXkK97Z_miiY9TPN5LtAM5oVynkJGXMso46rLnyI3JP_IZqmXJjc-Pv9FiO8ufuMImPQ1BUaUzQhbmPCCYFO30uJRyXA7_e9xs0kA3qlGi95GE9yvK2gZHws4-hCpmaQ
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=UbHjQUlbEE88PFIJ4g1fh4EW6BaIaam090dXYq_uMaBnDFHBSHo1AfL43XZhCFH3y5lBO_X1UTzyDKknu4q7yIk33MXADa5Ioq8F9oBtHSgGfTeURvi91nFWY4XYV8bkzIL63Dqzoj6m3t-4Y5tAqkmY0uWPe3O9Jeej2Qe9ALlBkHNy8IO-zSZeBZayT-T9HYk1kpxZ7WKFX2Ah0LvlvQfNyX5iER47KKSK0DU6-Uq-WjSx0ogBq6k59DFvRxh8
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=Y5-VekkmtKfh5PHDICQLzuoP4IovA8duWyJIw6PqTjlznRuSMuexhqke9xTIX0kUnvfTCOAKfcJrZg5_i9gcAra2CaXx41sB1yDhGpcZnK-S5P_LwQYaIAmM42XQ00j4d-2t85EAjQrP9t6MehSbgwJXkK97Z_miiY9TPN5LtAM5oVynkJGXMso46rLnyI3JP_IZqmXJjc-Pv9FiO8ufuMImPQ1BUaUzQhbmPCCYFO30uJRyXA7_e9xs0kA3qlGi95GE9yvK2gZHws4-hCpmaQ
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Ymwadiad - Mae'r e-bost hwn wedi'i fwriadu ar gyfer y derbynnydd(derbynyddion) yn unig. Os ydych wedi derbyn yr e-bost ar gam, dylech ddileu pob copi ohono ac unrhyw atodiadau, a thrin y cynnwys fel cynnwys cyfrinachol. Ymddiheurwn am unrhyw anghyfleustra y gall hyn ei achosi. Mae'r barnau a safbwyntiau a fynegir yn y neges e-bost hon yn rhai'r awdur ac ni ddylid cymryd eu bod yn rhai'r coleg. Mae'r e-bost hwn wedi cael ei wirio gan feddalwedd gwrthfeirysau. Nid yw'r coleg yn cymryd unrhyw gyfrifoldeb am unrhyw niwed sy'n gysylltiedig derbyn yr e-bost hwn, sut bynnag y'i hachosir.
Disclaimer - This email is intended for the addressee(s) only. If however you have received this email in error, please delete all copies of it and any attachments, and treat the contents as confidential. We apologise for any inconvenience this may cause. The views and opinions expressed in this email message are those of the author and must not be assumed to be those of the college. This email has been checked by anti-virus software. The college accepts no liability for any damages related to receipt of this email, howsoever caused.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=UbHjQUlbEE88PFIJ4g1fh4EW6BaIaam090dXYq_uMaBnDFHBSHo1AfL43XZhCFH3y5lBO_X1UTzyDKknu4q7yIk33MXADa5Ioq8F9oBtHSgGfTeURvi91nFWY4XYV8bkzIL63Dqzoj6m3t-4Y5tAqkmY0uWPe3O9Jeej2Qe9ALlBkHNy8IO-zSZeBZayT-T9HYk1kpxZ7WKFX2Ah0LvlvQfNyX5iER47KKSK0DU6-Uq-WjSx0ogBq6k59DFvRxh8
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=Y5-VekkmtKfh5PHDICQLzuoP4IovA8duWyJIw6PqTjlznRuSMuexhqke9xTIX0kUnvfTCOAKfcJrZg5_i9gcAra2CaXx41sB1yDhGpcZnK-S5P_LwQYaIAmM42XQ00j4d-2t85EAjQrP9t6MehSbgwJXkK97Z_miiY9TPN5LtAM5oVynkJGXMso46rLnyI3JP_IZqmXJjc-Pv9FiO8ufuMImPQ1BUaUzQhbmPCCYFO30uJRyXA7_e9xs0kA3qlGi95GE9yvK2gZHws4-hCpmaQ
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=UbHjQUlbEE88PFIJ4g1fh4EW6BaIaam090dXYq_uMaBnDFHBSHo1AfL43XZhCFH3y5lBO_X1UTzyDKknu4q7yIk33MXADa5Ioq8F9oBtHSgGfTeURvi91nFWY4XYV8bkzIL63Dqzoj6m3t-4Y5tAqkmY0uWPe3O9Jeej2Qe9ALlBkHNy8IO-zSZeBZayT-T9HYk1kpxZ7WKFX2Ah0LvlvQfNyX5iER47KKSK0DU6-Uq-WjSx0ogBq6k59DFvRxh8
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://url4.mailanyone.net/v1/?m=1hYpqc-000A9T-3W&i=57e1b682&c=Y5-VekkmtKfh5PHDICQLzuoP4IovA8duWyJIw6PqTjlznRuSMuexhqke9xTIX0kUnvfTCOAKfcJrZg5_i9gcAra2CaXx41sB1yDhGpcZnK-S5P_LwQYaIAmM42XQ00j4d-2t85EAjQrP9t6MehSbgwJXkK97Z_miiY9TPN5LtAM5oVynkJGXMso46rLnyI3JP_IZqmXJjc-Pv9FiO8ufuMImPQ1BUaUzQhbmPCCYFO30uJRyXA7_e9xs0kA3qlGi95GE9yvK2gZHws4-hCpmaQ
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This email and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and may contain confidential and/or privileged information. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by individuals or entities other than the intended recipient is prohibited. If you are not the intended recipient please notify the sender immediately and delete the email and any attachments. As a public body, Transport for Greater Manchester may be required to disclose this email or any response to it under the Freedom of Information Act 2000, unless the information in it is covered by one of the exemptions in the Act.
This email has been scanned for all viruses and passed through Content Control by the iCritical Email Security System.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|