Incomplete/unserviceable SAR submissions and deletion timeframes Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification materials like license or proof of address. Two slightly different questions here which I think are similar enough to be asked in a single post: Suppose they have a SAR processing backlog of 3 days by which time the data will have been deleted. Do they have why duty to first preliminarily review any requests and triage them by material auto deletion date? And secondly, forgetting any processing backlog related lead times, remembering that Bob had failed to include adequate identification proof to satisfy the data controller's procedures, must they make efforts to preserve the responsive materials even if they feel that they cannot yet responsibly disclose them to Bob while his request pends due to inadequate identification?
As I understand it there is no obligation to 'triage' SARs or keep data 'just-in-case' that would otherwise be deleted as a matter of routine. Can we amend or delete data following receipt of a SAR? It is our view that a SAR relates to the data you held at the time you received the request. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it is reasonable for you to supply the information you hold when you respond, even if this is different to what you held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DPA 2018, it is an offence to make any amendment with the intention of preventing its disclosure. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
When you make a request based on the GDPR, Art. 12(6) GDPR applies. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. As you can see, this only applies when the data controller (Blizzard) has reasonable doubts about your identity. If I understand it correctly, Blizzard provides services (games) which requires you to login with a username and password. So they have no doubts about your identity when you use their (paid) services with just a username and password. So there should also be no reasonable doubts when you make other requests when you are able to login to their website. A copy of your government ID seems unnecessary. Recital 57 also confirms that identification does not require a government ID: Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. A copy of your id, includes a photograph. The photograph could show health, religious, racial or ethnic information. That kind of personal data has much stricter rules defined in Art.9 . Most governmental IDs contain a national identification number. EU Member States can limit processing of those identification numbers even further. For example in the Netherlands processing of the identification number is only allowed when a specific law exists. So Blizzard is not allowed to process a Dutch national identification number. There are also ID convers] which hide sensitive information like document numbers and photographs in case you do need a copy of an ID. Also note that identification is only possible by comparing existing personal data with the provided personal data. I assume you did not provide a copy of your ID when registering. So many things which are shown on the ID do not make sense to sent to Blizzard. It does not know your place of birth, so it cannot verify it. Art. 5 requires 'data minimisation' for personal data. So they are not allowed to process more data than required. So you also do not need to send you more data than required. You should get an answer on your request within 30 days. However, since you ask to delete your account, the answer also might be that they will deny your request. They have to explain why they will not delete your account.
From the German lawyer association (&quot;Deutscher Anwaltverein&quot;) one can find the following (Google-translation): In the case of a purely preventive identity check, the officers are initially only allowed to determine the identity of the respondent. This means that you can ask for your name, date and place of birth, home address and nationality and have your ID shown - by the way, as a German citizen you don't have to always have your ID with you. &quot;You don't have to answer any questions beyond that,&quot; says lawyer Robert Hotstegs from the German Lawyers' Association (DAV). Of course, police officers often try to gather more information with emphatically casual questions. &quot;Well, where do we come from&quot; or: &quot;And where are we going now?&quot; Are typical examples. The police are not allowed to insist on an answer. Anyone who, as a respondent, is voluntarily too willing to provide information can harm themselves and possibly even give rise to concrete suspicions. So they are allowed to ask such things, but you don't need to answer everything. How to handle such situations, again according to the link above: “I recommend answering the survey as briefly and politely as possible. This has a de-escalating effect and helps to end the unpleasant situation as quickly as possible, ”says Attorney Hotstegs. However, you should always answer the questions about yourself. Because if the police cannot determine the identity of a person or only with great effort, they may take further measures to determine the identity. This includes taking it to the police station and, under certain circumstances, a search. Otherwise, these measures are not permitted without a specific reason.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data
Yes, that might be a violation of data protection law such as the DPA 2018 / UKGDPR, but not necessarily so. It depends on the details, for example on the purpose this camera serves. Background on Fairhurst v Woodard and on legitimate interests Fairhurst v Woodard is a significant case discussing implications of use of video surveillance outside of a commercial context, but it is a complex case due to the multitude of cameras involved and due to the somewhat unrelated privacy and harassment issues. Point 135 is about the Driveway Camera, which only surveilled public property and the claimant's property, but did not view any part of the defendants property. People are free to surveil their own property, and would then be covered by the UKGDPR household exception. But for surveillance outside of their own property, defendant would have to comply with the DPA 2018 and the UKGDPR, for which defendant would have needed a legal basis. The defendant argued that they had a legitimate interest (Art 6(1)(f) UKGDPR): 134. […] The Defendant submits that all his data collection and processing was necessary for the purposes of crime prevention at his property and in the car park However, a legitimate interest always require as balancing test. The legitimate interest can be “overridden by the interests or fundamental rights and freedoms of the data subject” (Art 6(1)(f) UKGDPR). It is not necessary here that these interests, rights, and freedoms are explicitly enumerated in statutory law. Here, a right is claimed without supporting legal basis: 134. […] Claimant submits that her right to privacy in and around her home overrides that purpose. However, a possible basis for this claim would be Art 8(1) of the European Convention on Human Rights, which is part of UK constitutional law: “Everyone has the right to respect for his private and family life, his home and his correspondence.” The court balances these rights and interests very differently for the different cameras. The Ring Doorbell is mainly focused on people who would ring the defendant's doorbell, and only incidentally captures passer-bys. Here, the legitimate interest was found to be valid. On the other hand, the Driveway Camera was mostly trained on claimant's property. Here, claimant's interests, rights, and freedoms override the claimed legitimate interests. Your scenario If the camera records the people living in the Green House when they go to or from their property, then yes, it seems like their rights would be affected. But in your scenario, the context of the camera is not clear: Why was it installed? If the purpose is crime prevention, is there evidence of such crimes in the neighbourhood, or are the cameras intended to counter a speculative threat? What is its field of view? Is it mainly trained on the Yellow House's doorstep and only captures the street as a background, or does it focus on the street? Is the camera's field of view masked off as far as possible to exclude public spaces? Does the camera record continuously, or is it only activated for certain events like when a doorbell is rung or when someone enters the Yellow House property? Does the camera also record audio? All of this is important because it factors into a legitimate interest balancing test. Maybe the Yellow House camera is more like the Ring Doorbell in the above case where the incidental capture of passer-bys was found to be acceptable, maybe it is more like the Driveway Camera that served no legitimate interest. There is no absolute right to be free of all surveillance. Instead, the interests and rights of the Green and Yellow house residents must be balanced appropriately. Where there is surveillance, it must be limited to what is necessary.
According to this article, the Malmö Administrative District Court found that the intent of the user is immaterial to whether a camera is being used for surveillance, so even if that is not why you are doing this, it counts legally as "surveillance". The law requires a permit from the länsstyrelse (county? government), according to the Kameraövervakningslag (2013:460) (article 8 states the requirement for permit, art. 16 tells you who to apply to). I believe that a tennis court would be considered a "public place", even if privately owned. Art. 17 tells you what goes into an application (there is probably a form), and art. 18 says that the kommun gets to weigh in. Presumably it would be critical to have a consent form signed before any recording happens, and you would include that in the application.