SAR Filter

[Nooks85]

Hi guys, I wonder if anyone could help. We have received a SAR for a Pupil, the pupil in question has the same initials as a couple of members of staff. The ediscovery is pulling through thousands of emails which include the members of staff. Do anyone know of a filter that will narrow the query down so it encapsulates the Pupils name and the Pupils initials and ignores the members of staffs initials?

 

Thanks in advance guys!

[synaesthesia]

Why would you include initials for an SAR? Unworkable.

[TechMonkey]

Why would you include initials for an SAR? Unworkable.

 

I agree, surname and/or full name search should be enough.

[Nooks85]

Thanks guys, the SAR that has been requested by the party is First/Surname and initials.

[synaesthesia]

Thanks guys, the SAR that has been requested by the party is First/Surname and initials.

 

An SAR for initials alone is unworkable, you are within rights to dismiss that - however have you misunderstood - i.e. middle initials? (Joe D. Bloggs for example)

[Nooks85]

Sadly I haven't misunderstood bud. This has been a request of the parents which has been passed to our DPO and passed to our department.

[paulkerton]

The use of initials is an attempt to make comments pseudonomynous, and as such you're bumping into similar initials becoming confusing... So they're trying to circumvent that and you're well within your rights to refuse it, as far as I am concerned - especially as it might reveal information they do not have the right to see.

 

But as always @GrumbleDook or your DPO are the people to speak to.

[synaesthesia]

Indeed, it is a form of obfuscation used by many - but it's a technological pitfall more than anything else. I mean, search this forum for any 2 characters and you will hit every single thread ever. It needs specialist tools i.e. regex just to get initials with a space either side and that doesn't help narrow down all the two letter words from initials. As a result. it is absolutely unenforceable.

[Nooks85]

Thank you for your advice guys, I really appreciate it. I will have to go back to the DPO.

[enjay]

Isn't SAR one of the reasons we use student initials rather than full names, so we don't need to include the information in a discovery?

 

Presumably you should also search for variant mispellings of the student's name too. There are multiple spellings of my name, for example, so if I wanted all information about me I'd need to search for each of those spellings. Plus typos of course!

[Nooks85]

Isn't SAR one of the reasons we use student initials rather than full names, so we don't need to include the information in a discovery?

 

Presumably you should also search for variant mispellings of the student's name too. There are multiple spellings of my name, for example, so if I wanted all information about me I'd need to search for each of those spellings. Plus typos of course!

 

I thought the same bud, I have spent the last 3 years advising all staff to use initials when referring to a student!

[GrumbleDook]

Isn't SAR one of the reasons we use student initials rather than full names, so we don't need to include the information in a discovery?

 

Presumably, you should also search for variant misspellings of the student's name too. There are multiple spellings of my name, for example, so if I wanted all information about me I'd need to search for each of those spellings. Plus typos of course!

 

No, you use initials so that it reduces the chances of some random person at the school being able to work out who you are talking about, or it is an agreed reference (like the teacher identifier when timetabling).

 

As it is commonly used and can be used with additional information to identify individuals, then it is personal data and covered by the SAR.

As the search will include where staff are discussing the individual it will be extremely hard to build a regex to remove random emails. However, it does make it more complex to look through things and so it may be reasonable to say it would take longer than the 1 calendar month to complete. Advice on that side will need to be taken from your DPO.

[Nooks85]

Thanks mate that's really helpful! As the party has specified First/Last name AND initials, we have built the ediscovery to only include emails and files with the query of First/Last name AND initials

[jmak]

Thanks mate that's really helpful! As the party has specified First/Last name AND initials, we have built the ediscovery to only include emails and files with the query of First/Last name AND initials

I appreciate that the SAR is essentially a nuisance for the school, but isn't that likely to exclude almost everything that the requestor wants? If you were writing a note/email which includes the subject's name, I would expect the chance of also referring to them by their initials in the same document to be pretty low. In that case the requestor could reasonably feel aggrieved.

[Nooks85]

I appreciate that the SAR is essentially a nuisance for the school, but isn't that likely to exclude almost everything that the requestor wants? If you were writing a note/email which includes the subject's name, I would expect the chance of also referring to them by their initials in the same document to be pretty low. In that case the requestor could reasonably feel aggrieved.

 

Highly likely that they will bud, but this is what our DPO has advised.

[enjay]

I appreciate that the SAR is essentially a nuisance for the school, but isn't that likely to exclude almost everything that the requestor wants? If you were writing a note/email which includes the subject's name, I would expect the chance of also referring to them by their initials in the same document to be pretty low. In that case the requestor could reasonably feel aggrieved.

 

Not at all. I often see emails where the subject is "JB" and the email body says "Joe has been struggling in class recently" or even "Joe Bloggs in Year 7 has been struggling...."

[TechMonkey]

Not at all. I often see emails where the subject is "JB" and the email body says "Joe has been struggling in class recently" or even "Joe Bloggs in Year 7 has been struggling...."

 

But if you search for initials AND name in subject or body then neither of your examples would match as they have one or the other. I don't think you can search for subject and body as one item.

[synaesthesia]

Indeed, hence why care is needed. You can immediately write off anything that's just "JB" with no other mention in the email/thread, so you'd need to carry out the search for "Joe B" "J Bloggs" etc as well - all the email systems' built in GDPR tools will do that with ease. That will also include email threads too - at least with Office 365, you can select conversation threads so if a thread has Joe B mentioned once but JB throughout the rest of the conversation in future emails then you can pull the whole thread and redact anything that isn't relevant.

You MUST make sure the requester is aware of this however and explain reasons behind it - not sure if that's a requirement of the law but it's certainly good practice/manners anyway

[psydii]

The solution we have found to this is to build a trained team who parse the larger results sets and filter them down in eDiscovery. The biggest one was for a legal discovery, 3 people took five days, and then another three days with two people going back and forward with the solicitors to finalise. The tools have got much better since then.

[GrumbleDook]

Thanks mate that's really helpful! As the party has specified First/Last name AND initials, we have built the ediscovery to only include emails and files with the query of First/Last name AND initials

 

That could be construed as being deliberately obstructive. If you go from tens of thousands of emails to five, then it will be obvious the school are taking the mickey. If the family are already disgruntled, then this has the hallmarks of a significant complaint being built!

[Ditto]

The more recent comments in this thread are now touching on an important point. Subject access requests are there to support individuals rights to access data about themselves. If I were to make an SAR, I am asking for data that is my data. Every reasonable effort to fully meet the request, whilst protecting others data rights, is required. The fact that it is challenging or a lot of work isn't the requestors issue.

 

Of course, they're will be a small minority who will try abuse these rights, but there is protection from vexatious requests.

[vikpaw]

You’d think it would be easier to just use the pupil ID number rather than initials. Make the search super simple.

[GrumbleDook]

You’d think it would be easier to just use the pupil ID number rather than initials. Make the search super simple.

 

Except staff want to use something was to work with … the fact that it makes SARs difficult is unimportant to what they do.

[garbage46]

I am late to the party as usual, in our responses to a SAR I always include a statement explaining our search criteria and justification along the lines of:

"As you will appreciate, we hold and work with a large amount of personal information on a daily basis. For context, there are almost x00 pupils that attend xxxxxx Academy and across our organisation as part of our day to day operations we send and receive thousands of emails every day. As part of our efforts to find and retrieve the personal information you have requested, we searched for emails which contained your child's full name or first initial and surname. Conducting a search using only a forename or initials alone would be likely to return tens of thousands of emails in which other individuals with the same forename or initials are the subject and contain no personal information about you."

[enjay]

I've said this before on similar threads, but can you get the parent to narrow down the scope of their request? They probably don't want every piece of information you hold about their child especially if it runs to hundreds of pages (unless they're just trying to make work for you / make a nuisance of themselves, I suppose), they almost certainly have a specific focus, e.g. information about their child's SEN provision, or information following a specific incident. Ask them what they're actually wanting to find out, then give them that.