> If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.
https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and...
I was asking for how my data was being processed. An email saying "Please perform action XYZ on this specific user" would, I think, fall under that description.
This is the case where you are a website, e.g, using "Login via GitHub" and GitHub sent you the users email address.
What you are asking is for a third party to tell you of any possible instance where your email address is mentioned. This is absurd.
If I have given you my email address, and then you process it, I think I am entitled to know how you've processed it. If you've stuck it in a DB, forwarded it to people via IM, or put it in a spreadsheet, etc.
You may think it is absurd, but my experience of filing DSARs is that most companies will send a suitably redacted copy of everywhere my data has been. And, yes, that includes emails.
How: "your email address is stored in our servers and kept until your account is active, then delete 90 days after. We also may share it with Jane Corp, because you gave us consent to, but not David Inc, because you did not give consent for it"
You are asking "show me the complete record of my ban, because I want to know who did it and I am entitled to it because that requires someone knowing some of PII." It's not that your data ended up somewhere you did not consent to or that they did not tell you how your data is processed, you are just uttering "gee-dee-pee-arr" and expecting to be enough to give you some information about you.
Are you sure that this is the intent of the law?
Yes. At least, that's my reading of https://www.legislation.gov.uk/eur/2016/679
If a decision has been made about me, I have the right to get information about it.
You are, of course, free to disagree.
There is a lot of exceptions and area for redaction, but the most significant in this case would be disclosing information that identifies another individual. As an example they have a fictional employee requesting a HR file. The HR file is likely to include information identifying managers and colleagues, or may include revealing information that relates to and identifies another individual. Redacting the names could be enough, or the emails might be heavily redacted down to only strict information regarding the employee without any parts of decisions or input given by the manager. If the intent of the requester is to get "what did my manager say about me", then that would not be valid.
But neither of those things are mutually exclusive with each other or holding a company to account to relevant standards. It isn't wrong to hold them to the standard, of course, but to claim that is only what is happening would be rather disingenuous (unless the author has a track record of defending people against transgressions of those standards when they themselves do not have something petty to be petty about in return).
It's missing the ad hominem harpiness that would suggest your version.