How can data received in online subject access request form be used by ACRO? Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office under the Data Protection Act. Their online request form solicits much intrusive information. What purposes may information so supplied be used for?
From ACRO's Subject access - further guidance web page: Why do I need to supply proof of ID? We need to be confident that we provide your personal data to the correct person, which is why we ensure we have sufficient proof of identity before we disclose any information. It also helps us to ensure we make a correct match on the PNC. As for this proof of ID (personal data) provided when submitting a Subject Access Request, ACRO's Privacy policy states: We gather information about site usage to help the development and improvement of services to the public, and to protect the integrity of our systems from malicious users. At the moment this information consists of: Statistical information obtained using Google Analytics. No information collected can be used to identify individual users. For more details about how this affects your privacy please visit the Google Analytics Privacy Centre. If you don’t want to send information to Google Analytics, an Opt-out Browser Add-on is also available or you can configure your browser to let you to choose which, if any, cookies are allowed to be created. Information obtained by our content management system to examine what people are searching for, what they find and occasions where no results are returned. Information collected can’t be used to identify individual users. Information provided by users through online forms; it's held in our UK-based secure data centres and is retained in line with the Data Protection Act 2018, the General Data Protection Regulation (EU) 2016/679, and our retention policies. However, I have not been able to locate publicly available copies of the retention policies referred to in the emboldened text.
BAD idea It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook. It isn't a fair use of the phonebook pictures - and you might not have a license anyway, as some people associate photos with numbers that they don't have a license to associate with anyway. But what if instead of a photo of the person, the first photo someone associated with the person is a photo of something like... crack cocaine, a photo of someone in a very compromising situation, just genitals, or some other thing that is just as tasteless or possibly criminal to share? In that case, your company is possibly committing defamation, and in case sharing or possessing of the image itself is illegal, your company is now the actor and liable. Depending on the content of the picture, distribution of pornographic material (possibly even underage material of that sort) could be up that alley just as much as hate speech through symbols, usage of banned symbols (such as swastikas in Gernamy) and many many others.
Art. 15(4) GDPR says: (4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this. In addition, Art. 85 GDPR requires member states to: [...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...] So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database). The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail. In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.
Is X considered personal data? Can you use X to directly or indirectly identify a natural person? In the data to which you have access can X be related to an identifiable natural person? If you answer yes to either of those questions then X is personal data. Article 4(1): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Scenario 1: you want to count each user agent that comes to your site, that's the only data you have, then the user agent is not personal data (it cannot be used to identify someone - unless it has a name and address etc, which seems highly unlikely - and you cannot relate it to anyone). Scenario 2: you have customer records with names, addresses etc (clearly personal data) and want to record each customer's user agent then the user agent is personal data (it relates to the identifiable natural person). Scenario 3: in one dataset you record that a user agent was associated with order ID 123456 and in another dataset you record that order ID 123456 was for John Smith (plus address etc), then the user agent is personal data (it relates to the identifiable natural person). Is this considered storing personal data? If X is personal data. Do I need user's consent to record X? If you want to record X and X is personal data, then you must have an Article 6 lawful basis for recording X. Consent is one of the six lawful bases. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
It's from a company called MarkMonitor that does trademark protection for clients - specifically around internet activities and that includes domain cybersquatting - which is illegal in the US under the ACPA, and of course that's what you were/are doing. So it could be a legitimate request as these things go. But that's not the whole story - the domain in the e-mail you posted is &quot;walmartt.com&quot; which is not only currently owned by Walmart Inc. but always has been, in fact the current Registrar of record is the aforementioned MarkMonitor. So either this isn't a legitimate request because you don't own &quot;walmartt.com&quot; and therefore this is spam or phishing (in which case feel free to delete it and move on with your life), granted that would be a pretty impressive bit of phishing since you are currently cybersquatting some Walmart-typo domains. Or you're just telling porkies all the way through your question for reasons of your own.
Per Art 12(6), they are allowed to ask for additional identify verification: where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. Additionally, Recital 64: The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. There is no consensus regarding what this means in practice: Must the controller use all measures that they can be reasonably be required to use? Or only those measures to verify the identity to a reasonable level of certainty? I agree with you that asking for a passport is excessive, and that email verification would be sufficient. However, that is just my personal opinion. The GDPR can also be interpreted in a way that asking for a copy of your passport is OK. Where they process a copy of your passport, that is personal data as well. You also have data subject rights with regards to this processing, for example the right to be informed of the purpose of this processing and of when the data will be deleted. If it is only used for the purpose of verifying your identity, the copy of your passport should be deleted immediately afterwards. The data controller may have additional obligations because a passport or ID card is a very sensitive document. E.g. Art 87 allows member states to impose additional rules. Most sensible controllers will therefore want to avoid processing passports, unless they only operate in specific EU member states.
From the article: The FBI is investigating alleged computer intrusion and theft against an unidentified “victim corporation” involving “confidential or proprietary information,” including tests, test forms and internal emails, according to a search warrant issued in the case. The reference to "computer intrusion" is not precise, but may mean that they suspect a violation of some provision of 18 USC 1030, which makes it a federal crime to access a computer without authorization, or to exceed authorized access, under certain circumstances and for certain purposes. So it's not necessarily just a civil matter. Specifically, 18 USC 1030(a)(2) provides: Whoever [...] intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains [...] information from any protected computer [...] shall be punished as provided in subsection (c) of this section. Subsection (c) provides for fines and imprisonment for various terms, making a violation of (a)(2) a felony or misdemeanor, depending on circumstances. Subsection (e) defines "protected computer" as any computer "which is used in or affecting interstate or foreign commerce or communication". It seems very likely that the computer in question was used in interstate communication, and that the SAT does affect interstate commerce. The fact that they got a search warrant means that they were able to satisfy a judge that there was probable cause to believe a crime was committed and the search would yield relevant evidence. We'd have to read the warrant, or the corresponding application, to know more.
I decided to rewrite this after the clarification in the comments. You can find the old version in the history. The question is not, actually, about a browser extension. It is about a web service that can be accessed by the browser extension. The way to access the service should make little difference, it could be clay tablets, homing pigeons, or this browser extension, what matters is the service. The service has two functions: Receive PII of the victim, sent by the customer, to calculate the probable email of the victim, and return this PII to the customer. The service operator could argue that the customer is really the data controller under GDPR rules, and that the service operator is only the data processor, but that is not a plausible use case. The customer would need to get and document the consent of the victim before the probable mail is calculated, so why would the customer pay the service operator for a service like this? There is already contact with the victim. Generate a database of specific company email patterns to enable 1. This would also use PII, from random employees of the company in question, and there is no customer to shield the service provider by pretending that consent was collected. The way around the first issue might be to sell the database and have all calculations on the customer's system, but that doesn't resolve the second issue, that of creating the database. This involves looking for patterns in PII of individuals, unless the target company is obliging enough to make the pattern public.