Can one require data of which one is the subject to be erased as well as disclosed? Under the GDPR, one is entitled to receive any data including CCTV footage that one may feature in if it still exists. However, can one as the data subject also require by request for such footage to be permanently erased, either before, or after, one has received it pursuant to an SAR?
The Art 15 GDPR Right to Access is pretty absolute, the Art 17 Right to Erasure not so much. Whether you can successfully request erasure of your personal data will depend on the purpose and legal basis for that processing. Short decision schema to check if erasure should be granted: no, if any of the Art 17(3) exception applies yes, if the data is no longer necessary for the purposes for which it is being processed (Art 17(1)(a)) yes, if the legal basis was Art 6(1)(a) consent (Art 17(1)(b)) if the data is being processed pursuant to a legitimate interest, yes, if the data subject successfully objected to the processing (Art 17(1(c)) yes, if the data is being processed for direct marketing purposes (Art 21(2)) yes, if the data subject objects on grounds relating to their particular situation, unless those grounds are overridden by a compelling legitimate interest For example, CCTV recordings on private property are often stored for some time for a legitimate interest to deter crime and to be able to investigate criminal acts if they should occur. A data subject could object to the recording, but would likely be unsuccessful: it doesn't make sense to let individuals opt-out from security measures, otherwise bad actors could use this to destroy evidence. Thus, the objection and consequently the request for erasure should be denied.
What are the reasons/ legal requirements that the police might need my personal information, given that I had not been able to provide any further information/ witness testimony to the incident that they were investigating? The police in england-and-wales have a duty to undertake reasonable lines of enquiry and to carry out a proportionate investigation in to allegations of crime. No-one is legally obliged to answer house to house questions but, notwithstanding the honesty and integrity of the majority of members of the public, any information held by the police may need to be corroborated to identify or eliminate suspects, witnesses, evidential opportunities or other lines of enquiry. Also, if it is established that someone has no information that may assist the investigation this is recorded to prevent duplication of effort thus enabling the police to focus their resources accordingly. All the while complying with the relevant privacy and data retention legislation.
Under GDPR Article 6 section 1(f), a lawful basis for processing is: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. It seems that informing a data subject of the availability of a possibly better-focused related site would be a &quot;legitimate interest&quot;, and merely doing a broad geo-locate on the IP does not seem to impact the &quot;interests or fundamental rights and freedoms of the data subject&quot; so it would seem this could be done without specific consent in advance. I don't know of any legal case on this specific point, however.
I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to: personal information published on the blog pages personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR) and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains) Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here. About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity". C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog. Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity. Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR). There may be other approaches apart from these 3, but that's a start for your considerations.
This article basically says &quot;it depends&quot;: If it is genuinely used to improve tenant safety then that is OK, but if it is used to track your private life then that is not acceptable. Cameras that cover communal areas used by several properties are generally acceptable, but cameras covering individual properties are much less so. It sounds like this falls into the latter category. Assuming you haven't got the camera yet, I suggest you write to the Landlord asking for a written justification of the cameras, and a policy for the use of the camera. E.g. it will only be viewed if an incident is reported. Once you have the justification you can then look for inconsistencies (e.g. if they aren't planning to snoop at random times, how are they going to notice someone up to no good? And how would they tell?) You could also just say &quot;no&quot;. The installation of this camera probably counts as a material variation of the rental agreement. You could also propose a compromise: you will install the camera, but only provide footage as you see fit rather than allowing your landlord to view the camera at any time. CCTV installations are covered by the GDPR, so you should ask your landlord for the associated paperwork. Amongst other things they will need to state how long they want to keep the footage and provide a justification for that. &quot;We might want to re-run it&quot; is not a justification. Having all this stuff written down will help if you ever suspect he is abusing the footage. Edit Another thought: does the landlord own other properties? Are they having cameras installed too? If not, why not? They should have a policy about this.
The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data. You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not necessarily a right to demand deletion, but if consent is withdrawn and you have no other basis for data processing, you have to delete. Note also that the consent basis would mean you have to actively contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult. But consider that the news media can process some data about some people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.
Maybe not. The ICO says that The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data. It might be valid to interpret the DPA / UKGDPR in a way that the relevant personal data undergoing processing in their system is the existence of the letters, but that you are not entitled to a copy of the letters. This is in line with the purpose of the right to access, that you can check what data they are processing about you and whether it is correct. If that argument holds and the data subject insists on receiving a copy of the letters, it might be legitimate to charge them a fee for these copies. But in practice: The data controller might not make this argument and just hand over the copies. It is worth a try. A right to access founded in data protection might not be the only way to receive a copy of these materials. If the letters are relevant for legal proceedings, they could perhaps be requested during the disclosure process.
These documents constitute personal data and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request". The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (Art. 15 (3) GDPR) GDPR applies to controllers of any kind, including government organisations. The subject access request can usually be a simple email. The ICO has a template for this: https://ico.org.uk/your-data-matters/your-right-of-access/ (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have). The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (see here for Germany; note that federal institutions are supervised by the BFDI, not the data protection authorities of the Länder). Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject. There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case. Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors: You can't object to processing based on consent (but you can revoke your consent), fulfilment of contract (but you can cancel your contract), a legal obligation on the part of the processor, or a vital interest (but you still have the right to erasure) Your right to portability and right to erasure does not apply if processing is based on a legal obligation or a public task (justice, parliamentary or government functions, statutory functions etc.) your right to portability also doesn't apply if processing is based on vital interest (e.g to protect someone's life) or legitimate interest of the processor. It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.