How long should I wait for a Data Access Request in Ireland A few weeks ago I made a Data Access request to an Irish company I've been doing business with for just over 10 years. I've not received any sort of response - not even an acknowledgment of my e-mail. Ignoring mails isn't unusual for this company but it is increasingly becoming a problem for me. This is why I have decided to get my data and go somewhere else. I've been told that I have a right to this data. Some people mentioned GPDR as a reason. Other people have talked about the Freedom of information act. How long do I need to wait? Do I have to send them reminder letters? If so, how many? What do I do if they continue to ignore me? I need this data to move on, and the Taxman will certainly need some of it
According to The official government page &quot;Freedom of information (FOI)&quot; FOI only applies to FOI bodies. These are mostly bodies that are publicly funded (for example, government departments). If you want to apply for records that are held about you by a private organisation, you can apply under data protection laws. FOI allows the public to have information about what the Government is doing and it is often used by journalists, campaigners and opposition parties. ... Organisations that are covered by FOI FOI laws apply to public bodies unless they are exempt. FOI bodies include: Government departments Bodies that were set up by an Act of the Oireachtas (for example, the Consumer and Competition Authority was set up by the Consumer and Competition Protection Act 2014), or established by a Minister or the Government A company where the majority of the shares are held by or on behalf of a Minister of the Government, or any of its subsidiaries A higher education institute that is publicly funded Some non-public bodies that get a lot of public funding Unless the company you are dealing with is an &quot;FOI Body&quot; it seems that the Irish FOI will not apply. The official Irish Government page on &quot;How to access your personal data under the GDPR&quot; states: Make your request in writing Ask as soon as possible and in writing. This can either be by letter or email. Seeking your personal data is known as making an access request or a data subject access request. You should state in the letter or email that it is an access request. This means that both you and the data controller will have a record of the request and its content if an issue later arises. Some large companies allow you to automatically download your personal information directly through their website. Contact the relevant data protection officer Many large organisations have a Data Protection Officer (or DPO) and they are generally the best person to contact about your request for information. You should be able to find their contact details in the privacy policy or ‘contact us’ section of the organisation’s website. Where there is no specific email address for a data access request, you should use the organisation’s general contact details. ... How will the company or organisation deal with my request? The data controller must respond to your request within one month. However, if you complain to the Data Protection Commission, the organisation may be given some extra time if it missed the deadline as a result of COVID-19. If the request is complex or involves a large amount of information, the data controller can extend the time to respond by a further two months. You should receive a written explanation for any extension within the initial one-month period. If your request is very broad and requires the data controller to provide a large amount of information and documents, you may be asked to reduce the number of documents containing personal data requested. However, you can insist on receiving all the information and documentation held. If you do, it may take longer to comply with your access request. In general, the data controller should respond to your access request in the same format the request was made, or in the way in which you specifically asked for a response. For example, if you emailed your request, the data controller should provide the information by email, unless you request otherwise. ... What can I do if I am unhappy with the outcome of an access request? If you are unhappy with the way your access request was processed, you can make a complaint to the Data Protection Commission (DPC)](https://www.dataprotection.ie/). The DPC is Ireland’s independent authority with responsibility for upholding the right of people in the EU to have their personal data protected. It monitors compliance with GDPR and other data protection legislation and deals with complaints in relation to data protection breaches. The DPC website contains helpful explanations of data protection law. You may be unhappy with the way your request was handled because: There was no response or a delayed response to your access request The response to the request was incomplete You believe the data controller wrongly relied on exemptions to not share your personal data with you How do I make a complaint? Complete the DPC’s online complaint form. You will be asked to provide evidence to support your complaint. This includes: Evidence of your access request Correspondence between you (or your legal representative) and the data controller and information in support of your belief that the data controller holds your personal Information The GDPR provides the right of access to one's personal information under Article 15, but leaves the details of times for response and handling of complaints to the national data protection authority and to national law. In the case of Ireland this is the Irish DPC. The GDPR dos not provide a right of private action (that is the right to bring an individual lawsuit) to enforce its data access provisions.That can only be done through a complaint to a national data protection authority.
Your analysis so far seems correct. You must comply with all applicable laws. The GDPR's Art 6(1)(c) legal basis clarifies that having to provide personal data is no excuse: that legal obligation is all the legal basis you need for sharing the personal data in accordance with your obligations. However, that legal basis doesn't generally excuse you from your other data controller obligations. For example, you should still inform the data subjects about the processing as per Art 13(3).
Yes, it also applies. However, an employment implies they agree to having employment related data stored and processed (e.g., to be paid). When there are performance related bonuses in the contract, this will likely (but IANAL) imply they agree to performance data being collected and stored appropriately. Furthermore I would assume most of such data processing (such as knowing who is responsible for a certain change, who created a file, modified it etc.) falls into "legitimate interests" of the employer, as this information may be necessary for operations. I'd assume (still IANAL) that much of the consequence wrt. GDPR is the right to have your data erased. So a company should be prepared to remove such data when an employee leaves the company, e.g., by clearing the responsible person fields upon request. At least for data where there is no legal requirement to have such data provenance. But: consult your lawyer for a proper legal opinion!
That is private. Who you work for is not information that is disclosed publicly by any state actor in Germany, just like your taxes. In fact, that or who you are employed at is often regarded as personal and private information. Nigh impossible through agencies Public agencies like the Fiskus (tax), Agentur für Arbeit, and immigration are not allowed to give any information about a person to anyone but that person or another agency that has the right to that information. Yes, (generally speaking) the tax office may not even say that a person exists (or doesn't) and what their tax number is to anyone but the person in question.
The information in telephone books is public. so are postal change-of-address records. So are records of the ownership of real estate. So are vital statistics such as birth records. So are voter registration lists -- i myself purchased a voter registration list (in digital form) for a municipality which showed people's names, addresses, and the years when they voted, when I was a political candidate for local office in NJ. It cost about $100. I believe that many states also make driver's license information available for a fee to marketers. Credit records are available for certain limited purposes, also. No doubt there are other public sources I haven't thought of. If such a site relies on public records, or other publicly available data, it is not illegal. Many such sites offer to remove names on an opt-out basis, but there is no legal requirement that sites do so. This kind of information is not considered nto be "private facts" under US tort law. Aside from opting out, if the sites provide that option, I don't think you have any recourse. One could ask the local legislature to pass a law prohibiting such sites, or making them require consent, similar to the GDPR that the EU has. But I don't know of any such law in the US to date.
You probably can't refuse to use such services. The relationship between you and these services is very different when you interact with them as a consumer, versus when these services are provided on behalf of your employer. In the latter case, the service is (or at least should be) bound as a data processor who can only* use your personal data as instructed by the data controller, your employer. Thus, it is your employer who determines for what purposes your data will be used, not the cloud service. Your employer has a legitimate interest in providing a modern and secure productivity suite to its employees, and in requiring you to use such services for efficient communication and collaboration. Of course it would be possible to provide some such services on-premises, but the GDPR doesn't really discriminate between self-hosted and third party services, as long as the third party service is contractually bound as a data processor. To a large degree, this is of course a legal fiction. The cloud services deploy new features all the time, and all that your employer can really do is agree to those changes, including agreeing to new ways for how to process your data. Also, the service provider may act both as a data processor on behalf of your employer for some purposes, but as their own data controller for others. E.g. in Google Workspace (formerly GSuite, formerly Google Apps for Business) Google collects analytics data about how you use their Docs product, and they use it for their own purposes. However, they would only process the document itself as a data processor. This is quite different in the consumer version where Google can use personal data for their own purposes, although within the limits of their privacy policy. Within your work account, you do have some privacy controls, similar to a consumer account. While your employer can set defaults and restrict features, you are not forced to share all data. E.g. in a Google Account, you can “pause” web and app activity (i.e. browsing history) that would otherwise be collected from Chrome browsers while logged in with your work account, or from Android devices that are managed by your employer. This data would potentially be used by Google for Ads, even with a Workspace account (I'm not sure). However, Google Workspace services generally do not feature ads themselves, e.g. the paid Gmail version does not feature ads. The largest real issue with the use of such services by an European employer is the international transfer of data to a non-EU jurisdiction, especially into the U.S. The GDPR offers many alternatives for how such transfers can be protected. In the past, the EU and US had used the Privacy Shield mechanism. However, it was found to be invalid in the 2020 Schrems II ruling, due to concerns about US mass surveillance. Subsequent guidance from supervisory authorities explained that it's not sufficient to use “standard contractual clauses” as an alternative protection, but that additional safeguards have to be implemented, which would effectively deny the personal data to actors in the US. Both Google and Microsoft offer some “data sovereignty” choices that prevent international transfers into the US. However, those have to be configured appropriately by your employer. Thus, instead of asking “can these services be used?” to which the answer is yes, it might be better to ask “is my employer using these services in a compliant manner?”. If you have concerns about such issues, you can contact your employer's data protection officer
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
The GDPR actually does require you to follow DNT in Article 21: In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. I think this is quite explicit.