When is personal data not in the scope of SAR

[garbage46]

My head hurts...

 

Steve sent an email to Dave:

 

From: [email protected]

To: [email protected]

Date: 05/03/2017

 

Subject: RE: Cover

 

Hi Dave,

 

Thanks for sorting out cover for my class tomorrow. I will be leaving at 2pm.

 

By the way, I spoke to Pete about the meeting on Wednesday and Pete has asked Mike to bring some samples of work.

 

If I don't see you tomorrow, have a great weekend!

 

Thanks,

Steve

 

Pete makes a SAR to see all emails containing his personal data. The email above has Pete's personal data, yes? How do would you respond, choose you answer from the following options:

(a) it is exempt because it is work related and for general business purposes.

(b) it is exempt because it is the personal data of Steve, Pete and Mike so disclosure to Pete would be in breach of DPA rights of Steve and Mike?

© it should be disclosed with redaction of red text

(d) only blue text should be extracted and disclosed

(e) other.. please explain

Edited August 2, 2019 by garbage46

[Seb1780]

What personal data does it contain?

[Suedonim]

I’m confused too. The email does not identify any data subject apart from the two email addresses which are legitimate interest

[garbage46]

My current understanding, following conversations and possibly conflicting advice from ICO, is:

Pete is mentioned and is identifiable.

Steve and Dave know who the Pete mentioned in the email is.

With the additional context of the email addresses others from the same school would be able to identify Pete.

"Pete has asked Mike to bring some samples of work" is Pete's personal data because it relates to something Pete has done. It is also Steve's personal data because he wrote the email and made the statement.

 

My uncertainty is:

Disclosure could be in breach off Steve's data protection rights.

Should this or any similar email be including in a SAR from Pete? I am leaning towards no...

Is this really personal data under the definition of a subject access request?

Edited August 2, 2019 by garbage46

[smurfomatic]

As I understand it, merely mentioning someone's name isn't personal data - otherwise you'd have to disclose every email they were copied into, e.g. on the "Teaching Staff" email list.

 

Even if this is classified as personal data, you don't have to provide it if it reveals other people's data:

 

Responding to a subject access request may involve providing information that relates both to the individual making the request and to another individual.

 

The DPA 2018 says that you do not have to comply with the request if it would mean disclosing information about another individual who can be identified from that information, except if:

 

the other individual has consented to the disclosure; or

it is reasonable to comply with the request without that individual’s consent.

 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/

[Seb1780]

I still see nothing that is personal data. Yes, you can (by inference) identify four people but the e-mail contains nothing that is personal about those people.

 

Knowing that Mr X is a teacher at School Y is *not* personal data - this is information that is in the public domain (often on our websites!). Knowing that Steve, Mike, Dave and Pete are having a meeting is *not* personal data - people in work situation have meetings - fact.

 

If, on the other hand, the e-mail had discussed the fact that Mike was bringing some samples of work to demonstrate why he should not be disciplined for poor performance, then that *would* be personal data.

 

Context is everything, and in the context you have presented there is no personal data that is not already in the public domain.