Hi, just to add to this, the judge also considered disclosing sources of PD and ordered disclosure of the names of the sources (document authors).
To summarise, GDPR (which is the same as Directive and DPA 98 in this respect) requires that where the PD are not collected from the data subject the data subject should be given "any available information as to their source". Unlike recipients the requirement does not include the option to provide "classes of" source. Nor does it matter that this information is not the PD of the requestor of the DSAR.
If we know the identity of a source we should therefore disclose it, but if that identity is someone's name and there is not consent to disclose it, we should apply the balancing test of whether in the absence of consent to disclose, it is reasonable to disclose anyway (in the case in question the judge decided it was).
Kind regards
Chris
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Phil Bradshaw
Sent: 06 June 2019 14:54
To: [log in to unmask]
Subject: Re: [data-protection] SAR Former employee emails
The advice to Tony was in a sense technically correct, but in practice "who was involved and the time/date" is most unlikely to be PD.
Additionally on "who was involved" there is the right in Art 15(1)(c) but in most cases that can be satisfied by reference to categories. e.g. "other members of staff"
See recent case of Rudd v Bridle & J&S Bridle Ltd [2019] EWHC 893 (QB) at [106]-[107]. "... the right did not encompass identities of individual recipients, but did encompass a description of a class or, if to a specific persons, a description of the type of person"
This was of course under s7 DPA 1998 and the wording is now subtly different but IMO that statement remains valid ... until overturned by a court of jurisdiction.
GDPR Art 15 = "access to ... the following information: (c) the recipients or categories of recipient to whom ..."
DPA98 " a description of— (iii) the recipients or classes of recipients to whom ..."
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|