Exercise - GDPR : Access to History of Interactions Data
situation
Under the UK GDPR (General Data Protection Regulation), you have the
right to access personal data held about you, including the history of
your transactions or services, as this constitutes data that identifies
and relates to you.
...yes...!...
-------------------------------------------------------------------------------------------------------
source: google.com
Key Rights & Processes:
-------------------------------------------------------------------------------------------------------
1. Right of Access (Subject Access Request):
-------------------------------------------------------------------------------------------------------
You can ask any organization for a copy of the personal data they hold,
which includes transaction history, invoices, and service records.
Under GDPR, organizations generally "cannot charge a fee" for fulfilling
a Subject Access Request (SAR) to provide a copy of personal data.
Fees are only permitted if the request is "manifestly unfounded or
excessive," particularly if repetitive, in which case a "reasonable fee"
covering administrative costs may be charged.
...i'll go broke…!...
...where would i get the time to fulfil...!?…
…
...do get in...and efficient...
…
...and then...
...and what...!?…
-------------------------------------------------------------------------------------------------------
2. Right to Data Portability:
-------------------------------------------------------------------------------------------------------
If the company processes your data based on consent or a contract, you
may be able to receive this data in a structured, commonly used,
machine-readable format.
...would follow...
...it would...
...will…!...
-------------------------------------------------------------------------------------------------------
3. Third-Party Data in Service Histories (e.g., Cars):
-------------------------------------------------------------------------------------------------------
In cases where service history contains personal details of a previous
owner (name, address), companies may refuse to provide the unredacted
documents citing GDPR, as they must protect the third party's personal
data.
However, they are generally obliged to provide you with a redacted copy
(blacking out personal details) that still shows the technical work done,
as this is your data for the vehicle you own.
...big 'hint...
...i don't de unknow...!...
...hiph-hiph-huhh...!...
-------------------------------------------------------------------------------------------------------
4. How to Request Your Transaction History:
-------------------------------------------------------------------------------------------------------
i. Formally write to the Data Protection Officer (DPO):
Send a request (often called a Subject Access Request or SAR) asking
for all records associated with your name, customer ID, or email
address.
...do...!...
ii. Request Redaction:
If a dealer or company refuses due to "third-party GDPR," ask them to
redact names/addresses of previous owners while providing the technical
records of work or purchases.
...it's be a vehicle...and ownership manual...
...[normally kept] on board the vehicle...
...mmm...
...it can confuse the ownership...
...when bought at second hand...
...owhhh…!?...
iii. Retention of Records:
Businesses are legally required to keep some records, such as invoices,
for financial, tax, or fraud prevention reasons (e.g., Anti-Money
Laundering laws), which takes precedence over requests for deletion
or erasure.
...owhh…!...
...won't the quote the "retention" rule...
...and never allow our deletion...!?…
-------------------------------------------------------------------------------------------------------
5. Limits of the "right to be forgotten":
-------------------------------------------------------------------------------------------------------
Under the UK General Data Protection Regulation (UK GDPR), individuals
have a "right to erasure" (also known as the "right to be forgotten"),
but this is not an absolute right, especially regarding criminal records
and prison data.
Prisons are required to process data for law enforcement purposes, which
often overrides erasure requests.
...like the retention rule...
...as above...
...mmm...
-------------------------------------------------------------------------------------------------------
I. When Can Records Be Deleted?
-------------------------------------------------------------------------------------------------------
Records are more likely to be deleted if the individual can show:
- The personal data is no longer necessary for the purpose it was
collected.
- The data was processed unlawfully.
- The arrest was unlawful, or it was established beyond doubt that
no offence existed.
- source: unlock.org.uk
If a prison refuses to delete your records they must inform you of :
- the reasons
- your right to complain to the Information Commissioner's
Office (ICO).
-------------------------------------------------------------------------------------------------------
II. How to Request Deletion
-------------------------------------------------------------------------------------------------------
While an outright deletion of a conviction is rare, you can request
to delete or correct personal data held in prison records:
i. Direct Request: Submit a request to the Ministry of Justice (MoJ) or
the relevant prison service managing your records.
ii. Right to Rectification: If information in your record is incorrect,
you have a stronger right to have it corrected.
iii. Record Deletion Process (RDP): If your case involves non-conviction
information (e.g., an arrest that did not lead to a conviction), you
may be able to use the ACRO Records Deletion Unit process.
iv. Process Time: The prison service has one month to respond to a
formal data deletion request.
-------------------------------------------------------------------------------------------------------
source: Information Commissioner's Office
...mmmm…
…
...can you access military records in GDPR...?...
Under UK GDPR and the Data Protection Act 2018, living individuals can
access their own military service records held by the Ministry of Defence
(MOD) via a free Subject Access Request (SAR).
Applications are made online or by post, requiring identity proof,
usually with a one-month response time, though backlogs may cause
delays...
- source: google.com
...oh they're flakey…
...only include about half our [fine personnel]…
...or point 1...!...
...be a tenth...
...mmm...
...it may...
...uhhhhh… ...
...oh it would...!...
...hmmm...
...yeah...!...
…
...yike what if i dress up as you...and make my access…!?…
…
...do you know...!?...do...!...
…
...in er...and um...and don't...
...uhmm...thank...
...mmmm…
…
...
...it says you're a ponce…!...
...
...how can i get that changed...!?…
…
...uh that may be under our/my debate...
…
...my...!...
…
...our...!...
…
...hmm...
-------------------------------------------------------------------------------------------------------
Key Retention Periods for Medical Records (UK):
-------------------------------------------------------------------------------------------------------
Under GDPR and UK law, medical records are generally kept for a minimum
of eight years after the last treatment, although GP records are often
retained for at least 10 years after death.
Adult Medical Records: Minimum of eight years after the conclusion of
treatment or last interaction.
Children and Young People: Until the patient's 25th birthday, or 26th
if the young person was 17 at the conclusion of treatment.
Mental Health Records: 20 years after the last contact, or 10 years
after death (8 years in Northern Ireland).
GP Records: Generally kept for a minimum of 10 years after a patient's
death.
Employee Occupational Health Records: Minimum of 40 years from the last
entry.
...then they are...!...
Retention periods vary based on the type of record: children's records
are usually kept until age 25, while mental health records are often kept
for 20 years.
...what the diff...!?…
...uh is one year...
- may be a considered by some different type of "flaw" if sick in
childhood ?
...oh weakness...
...yeah...
...and want to forget...
...uhh...when applicable...
...mmm...
-------------------------------------------------------------------------------------------------------
Key Considerations:
-------------------------------------------------------------------------------------------------------
i. GDPR Right to Erasure:
-------------------------------------------------------------------------------------------------------
While individuals have the right to request deletion, this generally does
not override the legal obligation to maintain medical records for these
specified periods.
...i'd be careful about this...
...now i know how that can get de un re-instated...!...
...do you know...!?…
...
...krrchhh!...
-------------------------------------------------------------------------------------------------------
ii. Records Management:
-------------------------------------------------------------------------------------------------------
Records should be destroyed or anonymized once they are no longer
necessary.
...will...!...
...in er um...
...or what...!?...
...sent to the kgb...
...what...!!...
...huhh...
...be in china...
...and they...
...we do keep our record..
...and long...
...when you don't want...
...uhhhhh...!?...
...then anonymize...
...do...
...need new method for that...!...
...would...
...until then they're in my B...won't be A if you can't pull that duty
and properly...
...oh not that...A...and then B...
...uh a bit…
...or what...
- 5-way designations instead of 2-way
- may be less of shock risk
...in either way...
...mmmm...
...keep it spread...
...need it up in the west...
...for 30 years...!...
...do...
...a bit...
...you agree...?...
...uhh…
...ahhh…
...if...
…
...keep it going...
...in...
...eh yeah...
…
...mmmm…
-------------------------------------------------------------------------------------------------------
iii. Variations:
-------------------------------------------------------------------------------------------------------
Retention policies can differ slightly, particularly between England,
Wales, Northern Ireland, and Scotland.
...
...calling that "significantly"...
...in varying...
...yeah...!...
...
...owhh...
...
...then...
...in dibh-dibh...!...
...
...huaaah...!...
...and i...
...
...owhhh...!...
-------------------------------------------------------------------------------------------------------
...and with that...
...what then...
…
...now how do i get that on yidd…
...what you mean "on"...!?…
...
...
-------------------------------------------------------------------------------------------------------
Comments