"No, GDPR won't let you read your boss' emails about you"

[Gongalong]

Hi folks,

 

I was interested to read this article from The Next Web, as per the subject: https://thenextweb.com/eu/2018/05/03/no-gdpr-wont-let-you-read-your-bosss-emails-about-you/

 

Essentially they interview a lawyer who says you are not able to get emails about you from your boss because they contain "personal thoughts". Yet reviewing the ICO's Subject Access Code of Practice, they mention that you would be required to provide emails - no mention of "personal thoughts", nor under Exemptions.

 

Is the requirement for Subject Access Requests changing under GDPR? I'm not spotting anything easily.

 

Interested to hear people's thoughts...

Edited May 11, 2018 by ZeroHour

[djrscally]

I think that emails specifically about you are definitely included in a SAR, unless one of the exemptions that would apply to any document about you applies to that specific email.

[pete]

"We asked a junior associate at $random_law_firm". Typically, junior associates are just about trusted to get coffee orders correct.

 

I think I'd want a little more consensus than "we asked one solicitor and they said no".

[Edutech98]

Yeah I defiantly disagree with the person here!

 

If it's personal data about you, you should be entitled to it. imo it's irrelevant if the data is someone's opinion on you its still about you.

 

I wonder what case law she is referring too when she mentions it as I'v never heard of it.

 

I read a case from a tribunal but I can't find it anywhere that was actually within a school. A parent did a SAR for any info about himself. The school provided everything they had and within it was a note from the teacher. The note said the parent acted aggressively and slammed the door on the way out of a parents evening.

 

He asked for the data to be deleted because he said it wasn't accurate, he claimed he didn't act aggressively or slam the door. He eventually took it to tribunal and the tribunal said that it didn't need to be deleted because the data was based on opinion not fact. If there was case law from higher courts that said the company didn't need to provide personal data of opinion the tribunal would have normally quoted it.

[Gongalong]

We've advised staff to be careful what they right down for this reason. It's all too easy to fire off an email that's rude about someone, which my understanding was they could read if they made an SAR!

[enjay]

Since when did it matter where the data was held? So they're suggesting I can't ask for one of my boss' emails but could ask for a Google Doc he wrote about me? I don't think so.