DSapseid Posted March 5, 2020 Posted March 5, 2020 We have had our first Data Subject Access Request! I have run the search on google vault for the emails for the time period and phrases as requested by our data protection person, this bit is all fine. However it has returned 3400 emails..... they want to be able to print them all off (or preferably just one for each email thread) then sit there with a sharpie marker and redact them all and then scan back in and send to the requester. I have 20 or so pst files from the vault download that only contain the messages relating to the search. I want to be able to either easily print all these emails or convert to pdf so that i can print from that. There seem to be lots of paid options for software, has anyone used anything to do something similar? or have another idea?
eddyc Posted March 5, 2020 Posted March 5, 2020 We have had our first Data Subject Access Request! I have run the search on google vault for the emails for the time period and phrases as requested by our data protection person, this bit is all fine. However it has returned 3400 emails..... they want to be able to print them all off (or preferably just one for each email thread) then sit there with a sharpie marker and redact them all and then scan back in and send to the requester. I have 20 or so pst files from the vault download that only contain the messages relating to the search. I want to be able to either easily print all these emails or convert to pdf so that i can print from that. There seem to be lots of paid options for software, has anyone used anything to do something similar? or have another idea? Also following with interest. We’ve been subject to approx 50 SARS so far and use Google Apps here too. Luckily the biggest SAR has only been 150ish items. To date, I’ve manually saved each email to PDF. I would live to know if there’s a quick free way to do this.
icemonkey Posted March 5, 2020 Posted March 5, 2020 Our Business Manager signed up for the premium version of Adobe Acrobat for a month to use the redaction tool for our most recent SAR - she said it saved her so much time redacting emails, she'll happily renew it next time she needs it. I should add, she started by redacting the emails by hand with a sharpie, what took her 3 days by hand took about an hour with Acrobat. The process I followed was: - Search vault per user (we only had to focus on 10 accounts but was around 700 emails) - Export search results as a pst for each account - Open each pst in Outlook (Thunderbird didn't like it) and print all emails as a pdf - Send the pdfs to the SBM for redacting with Acrobat Probably not the most efficient way to do it but it worked and took very little time. Not sure how well this would work for 3400 emails though! 1
AndyCrow Posted March 6, 2020 Posted March 6, 2020 We've helped in a large number of SARs and although I obviously dont know the case in question, 3400 emails sounds a lot. Remember only emails containing personal information of the person making the request needs to be included plus there a number of exemptions covering what needs to be included.
synaesthesia Posted March 6, 2020 Posted March 6, 2020 Don't forget that printing all that would be expensive in both time and resource and you need to charge accordingly. Frankly if someone is using a SAR for data in 2020 they should expect it in digital format, but unfortunately the same sort of people that still work on telegram and fax also insist you make it accessible for all (well, fewer realistically) by providing paper copy if requested.
DSapseid Posted March 6, 2020 Author Posted March 6, 2020 Ive just pushed it back asking if the time frame certain users can be narrowed as it is excessive!! The emails are for time period 2011-16 this just helps my case for a retention period!! If we had one there would be no emails to print!!
TwistedHelixis Posted March 6, 2020 Posted March 6, 2020 this just helps my case for a retention period!! If we had one there would be no emails to print!! Just wondering, if the user has deleted the emails but they were still held in an old backup somewhere would they still need to be printed?
DSapseid Posted March 6, 2020 Author Posted March 6, 2020 our emails are all on gsuite so once the retention policy kicks in they would be gone from vault. Just trying to look into if i can set different retention policies per ou in gsuite as the entire trust is on 1 gsuite setup and dont want to delete other schools emails!! If not i might look at GAM and see if i can delete emails that way.
TwistedHelixis Posted March 6, 2020 Posted March 6, 2020 our emails are all on gsuite so once the retention policy kicks in they would be gone from vault. The problem I seem to have is that some emails should probably be kept longer than others, so what do you set the retention period to?
john Posted March 6, 2020 Posted March 6, 2020 The problem I seem to have is that some emails should probably be kept longer than others, so what do you set the retention period to? Not sure if its an option in Google (as I don't use it) but in O365 you can tag items with different retentions, takes training of users etc but its doable for those LAC's that need longer retention etc... O365 then processes based on those tags you can set base tags that apply unless overridden as well.
mavhc Posted March 6, 2020 Posted March 6, 2020 So annoying that the solution to people asking for data is for you to delete it before they ask. So much knowledge lost. The internet is great because you can search old info. Your own files should be the same. Every other week I want info from an email that's 10 years old, and having to manually tag everything would waste so much time, same thing with old files. Sending someone 1500 scanned emails sounds like you really hate them. I'd just export them as text, load them into a WP and redact them there, no need to cope with the weirdness that is pdf
GrumbleDook Posted March 9, 2020 Posted March 9, 2020 So annoying that the solution to people asking for data is for you to delete it before they ask. So much knowledge lost. The internet is great because you can search old info. Your own files should be the same. Every other week I want info from an email that's 10 years old, and having to manually tag everything would waste so much time, same thing with old files. Sending someone 1500 scanned emails sounds like you really hate them. I'd just export them as text, load them into a WP and redact them there, no need to cope with the weirdness that is pdf Data minimisation is one of the principles of data protection. If you can't establish a need (purpose and lawful basis) and establish how long you need it for, then you get rid of it. Email is not a long term storage solution for knowledge management. It is an information transfer mechanism ... and if you are going to use it for knowledge management ... then bloody well manage it! You say tagging is a waste of time ... I say that not tagging and not putting the information in the right place to start with is a waste of time. 2
mavhc Posted March 9, 2020 Posted March 9, 2020 Only if you know what you'll want to know later. Search exists, why would we waste time having humans tag everything when we can just store everything and search it in seconds? Yahoo failed, Google won
GrumbleDook Posted March 9, 2020 Posted March 9, 2020 Only if you know what you'll want to know later. Search exists, why would we waste time having humans tag everything when we can just store everything and search it in seconds? Yahoo failed, Google won If you don't know what you want to know then you are falling at the first hurdle of data protection. You only collect the data you need. If you can't do that then you are processing data illegally. 2
mavhc Posted March 9, 2020 Posted March 9, 2020 How can I predict what I want to know in the future? Luckily I only process data about computers, and they don't have rights yet
GrumbleDook Posted March 9, 2020 Posted March 9, 2020 How can I predict what I want to know in the future? Luckily I only process data about computers, and they don't have rights yet It is not about prediction. As I have said, if you don't know what you want the data for you cannot have the data. In the same way, if you collect data for purpose X you can't suddenly use it for purpose Y. These are protections put in place to stop abuse of rights and to prevent risk of harm. I'll say it again ... if you don't know what you need the data for, it is illegal to process it. 1
Claireashton Posted March 9, 2020 Posted March 9, 2020 We delivered a webinar about DSARs last week, now available on YouTube: Hopefully some useful tips for everyone. Claire
mavhc Posted March 9, 2020 Posted March 9, 2020 It is not about prediction. As I have said, if you don't know what you want the data for you cannot have the data. In the same way, if you collect data for purpose X you can't suddenly use it for purpose Y. These are protections put in place to stop abuse of rights and to prevent risk of harm. I'll say it again ... if you don't know what you need the data for, it is illegal to process it. You can't have it? Or you can't process it? Bye bye innovation. Sorry, can't use AI to detect your cancer, because AI didn't exist when we took your DNA
GrumbleDook Posted March 9, 2020 Posted March 9, 2020 You can't have it? Or you can't process it? Bye bye innovation. Sorry, can't use AI to detect your cancer, because AI didn't exist when we took your DNA Collection of data for medical purposes has a massive amount of controls around why it is collected and how it can be used. If you don’t then it can be used for all sorts of things that can be detrimental to your rights. DNA collection is open to massive abuse and that is why there are so many safeguards for it. AI for detection of medical conditions is a growth area and it is used for good and bad. The good, earlier detection and allowing for targeted treatment. The bad, profiling of health risks by insurance firms including automated decision making. How much of each goes on is debated at the moment and this is why there are concerns about large data warehousing exercises where data is kept ‘just in case’. Anyone that thinks innovation can’t happen is missing the point. Like all scientific advancements, there have to be ethics tied in with it. Ethically, Privacy by Design/Data Protection by Design is a requirement. Applying ethics to research and innovation is important in so many areas ... why would this be any different? 3
garbage46 Posted March 10, 2020 Posted March 10, 2020 A bit late to the conversation, but we dealt with a similar request which resulted in thousands of emails. I was able to import the .PST files into one mailbox in Outlook. Next we sat in a meeting room with a projector and went through the emails one by one, tagging them using categories like "not the subject", "not in scope", "to be redacted", "to be released" etc. This took a few days, but nowhere near as long as we first thought. Once than process was finished I Exported the "to be redacted" emails to pdf and we use Adobe Acrobat Pro redaction tools. We need to sort out our email retention rules. Fingers crossed we do not receive many more SAR like this one. Working in a MAT, I dread to think how many emails would be returned if a bloke named "Mark" made a SAR. 1
ayggp Posted October 8, 2020 Posted October 8, 2020 Who in your opinions should be redacting this info? IT or someone else?
DSapseid Posted October 8, 2020 Author Posted October 8, 2020 Our head and deputy head did it between them over the course of a weekend, i offered but they said that i had found it all and then i had to scan it back in after they had redacted it all.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now