Tweet
Hello.. I would be interested in views on this.
I sent a SAR request to companies A and B. There is also another company involved, company C, but I did not send them a SAR as they had no info that I needed. Company A complied, and also sent me all their corrspondence between company A and B (emails I was not ccd in).
Company B said they spoke to their lawyers, and do not need to comply. I don't think Company B knows I have the correspondence between A and B. Company B is a UK company, so I complained with the ICO. The ICO asked for correspondence between A and B, whcih I sent. After 3 months, I heard this morning from ICO and they agreed with me, and sent a letter to company B saying they did not comply with my request, and they have 28 days to do so.
Not even 20 mins later, I got an email from company B, saying the below.. Would be interested to know from experts to see if this is right? Thank you
"
I have recently received your complaint from ICO and further discussed and received advice from them.I refer you to the ICO website, whereby I continue to reiterate our position in regard to your compliant.
Key data protection terms you need to know | ICO
We (at Company B ) are a Data processor, we have to protect people’s personal data – but we only process it on behalf of the Data Controller, in this instant (Company C) being the Data controller. There is no reason to have your data unless the controller did not ask us to do something with it.
We are therefore not obliged to compile with your subject access request (SAR). Despite this, we have already given you everything we have on this matter.
If you require further information, you will need to contact the Data controller.
I sent a SAR request to companies A and B. There is also another company involved, company C, but I did not send them a SAR as they had no info that I needed. Company A complied, and also sent me all their corrspondence between company A and B (emails I was not ccd in).
Company B said they spoke to their lawyers, and do not need to comply. I don't think Company B knows I have the correspondence between A and B. Company B is a UK company, so I complained with the ICO. The ICO asked for correspondence between A and B, whcih I sent. After 3 months, I heard this morning from ICO and they agreed with me, and sent a letter to company B saying they did not comply with my request, and they have 28 days to do so.
Not even 20 mins later, I got an email from company B, saying the below.. Would be interested to know from experts to see if this is right? Thank you
"
I have recently received your complaint from ICO and further discussed and received advice from them.I refer you to the ICO website, whereby I continue to reiterate our position in regard to your compliant.
Key data protection terms you need to know | ICO
We (at Company B ) are a Data processor, we have to protect people’s personal data – but we only process it on behalf of the Data Controller, in this instant (Company C) being the Data controller. There is no reason to have your data unless the controller did not ask us to do something with it.
We are therefore not obliged to compile with your subject access request (SAR). Despite this, we have already given you everything we have on this matter.
If you require further information, you will need to contact the Data controller.
Comment