SAR Redactions

[klee]

We have received a SAR from an ex member of staff.

 

There will be many documents/meals that we will share that she will have seen before, but there will be some emails in particular that she may not have seen. Do I redact the sender of these emails or is the data subject entitled to see this?

 

Many thanks

[Edutech98]

Yeah your right if the personal data belongs to someone else, i.e you can identity another person from it, then you can redact it. Alternatively the other person can also consent to it being included, for example if the head teacher sent an email about a disciplinary, they may well stand by what they said in the email and consent to it being included - although they are under no obligation to do so.

[IrritableTech]

In a situation like this it may be sensible to pass the documents to your legal team and have them confirm the suggested redactions.

[grahamd22]

We have just gone through this and had to add the word redacted to any names shown it took 3 members of staff at least 5 days to do this for over 3000 emails including the attached documents, I believe it is all emails that refer to the person in question whether they have seen it or not. Edited July 10, 2018 by grahamd22

[enjay]

We have just gone through this and had to add the word redacted to any names shown it took 3 members of staff at least 5 days to do this for over 3000 emails including the attached documents, I believe it is all emails that refer to the person in question whether they have seen it or not.

 

We printed everything out, went over it with a marker pen then scan it.

 

To be honest, if you have 3000 emails to send I think you should try and narrow down the scope of the SAR. Also, isn't there a time cap on this, or is that only FOIA requests?

[klee]

Many thanks, we believe we have collated all the relevant information at this point. After pulling out 4400 emails I have removed the 3000+ that don't actually contain facts, information, opinions, comments about the data subject! We will need to see if we can refine our searching in the future!

 

Race against time now to redact where appropriate and get this wrapped up before the end of term.

 

Hope we don't get too many of these, they are so time consuming and this member of staff was only here for 2 years!

[synaesthesia]

Surely as far as emails are concerned it's only emails sent to and from the subject?

[klee]

I believe it is any email that refers to them. For example where two members of staff have had a communication about how well the data subject did in their most recent observation I have included it but when it was a communication about arranging a meeting regarding the data subject I didn't include it as there wasn't actually any information about them.

[Bigbird7]

Surely as far as emails are concerned it's only emails sent to and from the subject?

 

Any email that the subject is identifiable in should be included in the SAR response. It’s why schools should follow the excellent advice around email practice included in the IRMS toolkit for schools

[synaesthesia]

So, if two members of staff have a private email conversation directly naming me along the lines of "Ugh, synaesthesia is a complete pain in the bottom, rude, crude and unhelpful. I hope he gets the sack soon.", that would count in an SAR?

[Bigbird7]

So, if two members of staff have a private email conversation directly naming me along the lines of "Ugh, synaesthesia is a complete pain in the bottom, rude, crude and unhelpful. I hope he gets the sack soon.", that would count in an SAR?

 

Yes! Standard safeguarding guidance report facts and not opinions

[synaesthesia]

That raises an eyebrow; hell, it raises both two. May have to look into that a little more, as I'm sure that raises legal issues on it's own; an employee fired for example due to gross misconduct would obviously incite quite an email chain and that employee would then have grounds to raise an SAR to see that communication... time to do some homework!

[mjk]

If your email retention policy is short, the problem is solved.

[BOOT]

If your email retention policy is short, the problem is solved.

...Unless you have backups.

[mjk]

Yes you would have to take the backup retention into account in the policy.

[Edutech98]

...Unless you have backups.

 

The general advise from the ICO is that they will not require you to grant individuals subject access to information stored in a backup. So if you have deleted from your live system, but still have the data in your backup, you will not be expected to provide this data in your SAR response.

[BOOT]

Maybe it's just my own experience; as most of the requests I've seen and the requests I make myself, do explicitly request data stored in backups.

[steveg]

Can I ask how you went about collecting all of the emails from various staff mailboxes, or were they just from some key staff?

 

Steve

[enjay]

Any email that the subject is identifiable in should be included in the SAR response. It’s why schools should follow the excellent advice around email practice included in the IRMS toolkit for schools

 

So, if a current or former employee sends in an SAR in response to a disciplinary let's say, we'd have to turn over every email between me and my technician about long-resolved support calls, the curriculum support admin would have to turn over copies of every photocopying request ever submitted and so on? Madness!

 

In a recent similar situation here, we were advised to only turn over emails from specific staff members in a specific date period, with names and dates agreed by the requester.

[Edutech98]

We search any central systems (i.e file server, Sims etc) and then also email all staff asking them to fwd any emails relevant to the particular SAR.

 

All out staff are basically told in DP training about this and are told do not send emails about people that you would not confidently be able to stand up in front of a tribunal and justify.

 

If the SAR is excessive, i.e. the person wants "everything" than you can charge a fee for the admin costs of complying. The requester can then decide if they pay or they can narrow down the search as above.

[grahamd22]

Another problem you will face is that emails are .msg format and only accessible with a microsoft product or converted as authorities are asking for pdf format. Hard copies would be chargable along with time spent.

[enjay]

Another problem you will face is that emails are .msg format and only accessible with a microsoft product or converted as authorities are asking for pdf format. Hard copies would be chargable along with time spent.

 

That's one of the reasons we print, redact on paper and scan.

[forkies]

That's one of the reasons we print, redact on paper and scan.

 

We used to do this but found when scanned it showed through the redaction ink. So we have now PDFd all documents (scanned if needed) then used PDF to electronically redact. This allows us to have an original electronic file without redaction and with redaction. Especially useful for permanent exclusion hearings and such.

[enjay]

We used to do this but found when scanned it showed through the redaction ink. So we have now PDFd all documents (scanned if needed) then used PDF to electronically redact. This allows us to have an original electronic file without redaction and with redaction. Especially useful for permanent exclusion hearings and such.

 

I've just tried that here, and you couldn't read through it. Maybe I have either a better marker pen or a worse scanner than you...

[christhetech]

This is exactly the reason why I have always drummed it into my colleagues to "shred it as soon as you have finished with it".

If you do not have the information, you can't be hung for it! Our email backups run twice a week, so as long as information is properly deleted before the back-up is run, it's gone forever! A lot of emails don't need to be kept, once they have been read, and if it's something that they need to keep for future reference, I advise them to archive it. It's all about the housekeeping!

I also constantly bang on about the content of their emails and urge them not to put any personal differences or personal opinions in writing unless they would be prepared to stand up in a court of law and defend them.