Data Protection - my personal data

ekeitout

An article today on
BBC Radio Kent highlighted the issue of your personal data being held for years sometimes, by various clubs, gyms, financial advisers, therapists, and others that you might have last visited/dealt with many years ago. Does m.s.e. have a proforma letter to send to these people requesting either they send you your data, or confirming that they have safely destroyed it?

[Deleted User]

You can send a SAR if you want to see what they hold on you.

No particular template needed, but remember to send £10 (until GDPR comes in next year).

ekeitout

Thanks, I'll look into that.

dunstonh

BBC Radio Kent highlighted the issue of your personal data being held for years sometimes, by various clubs, gyms, financial advisers, therapists, and others that you might have last visited/dealt with many years ago.

Financial advisers should have it for the rest of time.

Does m.s.e. have a proforma letter to send to these people requesting either they send you your data, or confirming that they have safely destroyed it?

Firms should destroy data automatically over time that is no longer required for regulatory or legal reasons.

Where there is a liability/legal issue the data can be retained until the liability/legal issue no longer exists. In the case of financial advisers, there is no long stop. Hence, they have to effectively hold the data on you until death. Indeed, the death of their spouse too in many cases.

glennevis

I have been receiving flyers from a company I last bought furniture from in 1995. I didn't need to pay for an SAR to know they had kept my address on file. Just phoned them up and asked them to take me off their database.

Vectis

I'm wondering what data you think a gym or club might hold on you? Obviously that you were a member of the gym or club, perhaps your D.O.B, address at the time etc, maybe an email address. Any credit or debit card details are likely to be out of date now.

You could send a SAR and £10 to anyone you've ever dealt with in the past but that could work out pretty expensive. And what would you expect to find out anyway?

discat11

^^ I would agree with Vectis.

1. It's £10 for each & every one and up to 30 days for a reply.
(After 25/5/18 it's free and up to 40 days).

2.Most companies ( quite properly) only gather what they need to be able to supply services/goods, so for most online stuff it'll be name & email address so hardly worth even requesting anyway -far better to simply ask them to delete your details from their marketing lists.

It's fairly easy to find out without even asking most -try to register again with false details and see what they ask for at registration.
OK it'll only show you what they gather now, but it's a fairly reliable indication.

It's only 'Personal information' legally if it can 'personally identify you'.
i.e. an uncommon full name with date of birth etc.

an email address without something identifiable within it isn't classified as PII nor is any more common name.