We don't know whether the most recent response to this request contains information or not – if you are Paul McCrory please sign in and let everyone know.

Protecting data subjects rights to access metadata related to their personal data.

We're waiting for Paul McCrory to read recent responses and update the status.

Dear Information Commissioner's Office,

Attached below is the anonymised text of a response received from a member of, and as I understand and Advisor to, the European Parliament's Civil Liberties, Justice and Home Affairs committee. Prior to submitting this FOI request, I undertook a search for a position statement on data subject's rights to access metadata on the ICO's website, but without success.

Please confirm the ICO's policy on data subject's rights of access to metadata associated with their personal data?

Yours faithfully,

P. Mc Crory

"
XXXXXXXX XXXX <[email address]>
Tue, 11 Jun, 11:17
to me

Dear XXXX XX XXXXX,

The EU General Data Protection Regulation does not foresee a special category of "metadata". Any data related to an identified or identifiable natural person is considered personal data and is as such protected under the GDPR. This includes metadata.

The right to obtain a copy of your data, like all data subject rights, can however only be exercised against the data controller, not the processor.

If you have indications of wrongdoing, I suggest to file a complaint with the responsible data protection supervisory authority, in your case the Information Commissioner's Office, www.ico.org.uk.

Best regards, XXXX XXXXXXXX

--

XXXX XXXXXXXX

Adviser on Civil Liberties, Justice and Home Affairs

Greens/EFA in the European Parliament

PHS 04 C 079, Rue Wiertz 60, B-1047 Brussels

+32 228 XXXXX | [email address] | @XXXXXXXX
"

Information Access Inbox, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Dear Information Commissioner's Office,

I would be grateful if you would post an update on the status of this request?

Thank you.

Yours faithfully,

P McCrory

Dear Information Commissioner's Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Information Commissioner's Office's handling of my FOI request 'Protecting data subjects rights to access metadata related to their personal data.'.

To the best of my knowledge, the ICO has not provided a response to this as yet and not responded to my request for an update on the FOI request ( https://www.whatdotheyknow.com/request/p... )?

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...

Yours faithfully,

Paul McCrory

Information Access Inbox, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

17 January 2020

 

Case Reference Number IRQ0895618

 

Dear Mr McCrory

Thank you for your request for information. We received your request on 30
November 2019. Please accept my sincere apologies for the delay in our
response.
 
We have considered your request under the Freedom of Information Act 2000.
 
Your request
 
‘Dear Information Commissioner's Office, Attached below is the anonymised
text of a response received from a member of, and as I understand and
Advisor to, the European Parliament's Civil Liberties, Justice and Home
Affairs committee. Prior to submitting this FOI request, I undertook a
search for a position statement on data subject's rights to access
metadata on the ICO's website, but without success. Please confirm the
ICO's policy on data subject's rights of access to metadata associated
with their personal data?’
 
Our response 
 
I can advise that we do not hold a policy on data subject’s rights of
access to metadata.
 
We have published guidance on our website about what the GDPR defines as
personal data. Please find a link to this below.
 
[1]https://ico.org.uk/for-organisations/gui...
 
This guidance explains the factors that should be considered in order for
a data controller to determine whether they are processing personal data.
These are:
 

* identifiability and related factors;
* whether someone is directly identifiable;
* whether someone is indirectly identifiable;
* the meaning of ‘relates to’; and
* when different organisations are using the same data for different
purposes.

In accordance with the right of access (Article 15, GDPR) an individual is
entitled to a copy of their personal data. If metadata held by a data
controller constitutes a data subjects personal data it would fall within
the right of access provided to them by Article 15.
 
Please also find a link to the Subject Access Code of Practice which you
may find helpful.

[2]https://ico.org.uk/media/for-organisatio...

This concludes our response.
 
Next steps
 
I hope this response is clear. If you would like me to clarify anything
about the way your request has been handled please contact me.
 
I acknowledge your request for an internal review and we will aim to
respond by 4 February 2020 which is 20 working days from the day after we
received your recent correspondence.   
 
Following our internal review, if you remain dissatisfied with the way we
have handled your request, there is a statutory complaints process and you
can report your concern to the regulator. I have included information
about how to do this separately.
 
Yours sincerely,
 
 
 

Sarah Whelan
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6322  F. 01625 524510  [3]ico.org.uk  [4]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [5]privacy
notice

 
 
 
 

References

Visible links
1. https://ico.org.uk/for-organisations/gui...
2. https://ico.org.uk/media/for-organisatio...
3. http://ico.org.uk/
4. https://twitter.com/iconews
5. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

20 January 2020
 
Case Reference Number RCC0904601
 
Dear Mr McCrory,
 
Information review request
 
I write in response to your request of 7 January 2020 in which you
requested a review of your information request to The Information
Commissioner Office reference IRQ0895618.
 
Your request
 
You wrote to us on 5 December 2019 with an information request and stated:
 
“Information Access Inbox <[ICO request email]>Subject:
Freedom of Information request - Protecting data subjects rights to access
metadata related to their personal data. Dear Information Commissioner's
Office, Attached below is the anonymised text of a response received from
a member of, and as I understand and Advisor to, the European Parliament's
Civil Liberties, Justice and Home Affairs committee. Prior to submitting
this FOI request, I undertook a search for a position statement on data
subject's rights to access metadata on the ICO's website, but without
success. Please confirm the ICO's policy on data subject's rights of
access to metadata associated with their personal data? Yours faithfully,
P. Mc Crory”</[ICO request email]>

  
Our response
 
My colleague Sarah Whelan wrote to you on 17 January 2020 with a response
to your information request. She stated:
 
“I can advise that we do not hold a policy on data subject’s rights of
access to metadata.
 
We have published guidance on our website about what the GDPR defines as
personal data. Please find a link to this below.
 
[1]https://ico.org.uk/for-organisations/gui...
 
This guidance explains the factors that should be considered in order for
a data controller to determine whether they are processing personal data.
These are:
 
< >identifiability and related factors; whether someone is directly
identifiable; whether someone is indirectly identifiable; the meaning of
‘relates to’; and when different organisations are using the same data for
different purposes. In accordance with the right of access (Article 15,
GDPR) an individual is entitled to a copy of their personal data. If
metadata held by a data controller constitutes a data subjects personal
data it would fall within the right of access provided to them by Article
15.
 
Please also find a link to the Subject Access Code of Practice which you
may find helpful.

[2]https://ico.org.uk/media/for-organisatio...

This concludes our response.”
 
 
Your request for review
 
On 7 January 2020 you wrote to us to request an internal information
review stating:
 
“Dear Information Commissioner's Office, Please pass this on to the person
who conducts Freedom of Information reviews. I am writing to request an
internal review of Information Commissioner's Office's handling of my FOI
request 'Protecting data subjects rights to access metadata related to
their personal data.'. To the best of my knowledge, the ICO has not
provided a response to this as yet and not responded to my request for an
update on the FOI request”
 
Our internal review
 
I have reviewed your information request response as requested. The review
was based on your objection to non-compliance to adhere to the 20 working
day response time to respond to your information request. I note you have
since received your response from my colleague.

 
I would refer you to the unprecedented demand we have been receiving to
our service since the introduction of the GDPR and raising of our profile
which resulted from this. Our requests for information have increased by
54% overall since this time and we are currently reviewing our staffing
levels. As a result of this there are times when our information requests
are late (last month we delivered 92% of our reviews within the statutory
20 day deadline). Unfortunately this means that 8% are not delivered
within the 20 working days and on this occasion yours was one of those
requests. For this we apologise and accept that this is not the service we
wish to deliver at The Information Commissioners Office. I apologise again
for your delay and I uphold your complaint.
 
This concludes my information review and this is my full and final
response. May I take this opportunity to thank you for your interest in
the work of The Information Commissioners Office.
 
 
Complaint procedure
 
If you are dissatisfied with the outcome of this review you can make a
formal complaint with the ICO in its capacity as the regulator of The
Freedom of Information Act 2000. Please follow the link below to submit
your complaint:

[3]https://ico.org.uk/concerns/

 
 
 
 
Yours sincerely
 
 
 
 
 
 

Elizabeth Baxter
Information Access Group Manager
 
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840  F. 01625 524510  [4]ico.org.uk  [5]twitter.com/iconews
For information about what we do with personal data see our [6]privacy
notice
Please consider the environment before printing this email

References

Visible links
1. https://ico.org.uk/for-organisations/gui...
2. https://ico.org.uk/media/for-organisatio...
3. https://ico.org.uk/concerns/
4. http://ico.org.uk/
5. https://twitter.com/iconews
6. https://ico.org.uk/global/privacy-notice/

We don't know whether the most recent response to this request contains information or not – if you are Paul McCrory please sign in and let everyone know.