> I replied with a (not so-friendly) email pointing out that I was entitled to a copy of any messages because they contain my personal data.
Hum, no? You are entitled to a copy of the data that you provided to the data processor. Your messages, your records, even your IP address for the sessions on your devices.
A message that someone mentions you is not your data.
It's an interesting take (what is "data" anyway? does it include "the CEO thinks <person> is a dick" if that record is kept on company infrastructure?) but I don't think it'll hold up in court. If the author decides to press the ICO to take action, perhaps we may find out one day.
That said, scraped data about you definitely falls under GDPR protections even if you never provided any data yourself.
Imagine I am in a dating site and want to find out all the people that expressed interest on me. I go then and file a GDPR request, claiming that those that mentions of me is "data collected about me" and therefore I am entitled to it.
Someone talking about you, or references about your PII are not PII themselves. To try to claim otherwise is absurd.
its looks like internal discussions about someone are within scope of GDPR.
> If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.
https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and...
I was asking for how my data was being processed. An email saying "Please perform action XYZ on this specific user" would, I think, fall under that description.
This is the case where you are a website, e.g, using "Login via GitHub" and GitHub sent you the users email address.
What you are asking is for a third party to tell you of any possible instance where your email address is mentioned. This is absurd.
If I have given you my email address, and then you process it, I think I am entitled to know how you've processed it. If you've stuck it in a DB, forwarded it to people via IM, or put it in a spreadsheet, etc.
You may think it is absurd, but my experience of filing DSARs is that most companies will send a suitably redacted copy of everywhere my data has been. And, yes, that includes emails.
How: "your email address is stored in our servers and kept until your account is active, then delete 90 days after. We also may share it with Jane Corp, because you gave us consent to, but not David Inc, because you did not give consent for it"
You are asking "show me the complete record of my ban, because I want to know who did it and I am entitled to it because that requires someone knowing some of PII." It's not that your data ended up somewhere you did not consent to or that they did not tell you how your data is processed, you are just uttering "gee-dee-pee-arr" and expecting to be enough to give you some information about you.
Are you sure that this is the intent of the law?
Yes. At least, that's my reading of https://www.legislation.gov.uk/eur/2016/679
If a decision has been made about me, I have the right to get information about it.
You are, of course, free to disagree.
There is a lot of exceptions and area for redaction, but the most significant in this case would be disclosing information that identifies another individual. As an example they have a fictional employee requesting a HR file. The HR file is likely to include information identifying managers and colleagues, or may include revealing information that relates to and identifies another individual. Redacting the names could be enough, or the emails might be heavily redacted down to only strict information regarding the employee without any parts of decisions or input given by the manager. If the intent of the requester is to get "what did my manager say about me", then that would not be valid.
It's missing the ad hominem harpiness that would suggest your version.
But neither of those things are mutually exclusive with each other or holding a company to account to relevant standards. It isn't wrong to hold them to the standard, of course, but to claim that is only what is happening would be rather disingenuous (unless the author has a track record of defending people against transgressions of those standards when they themselves do not have something petty to be petty about in return).
This is absolute nonsense and there is no such limitation in the GDPR which, if you had even a passing familiarity with it, you would know. Maybe don't ramble about things you don't understand?
In particular, art 14 is:
> Information to be provided where personal data have not been obtained from the data subject