Subject Access Request data format

Erebos

Wondering if it’s possible, or do I have a right to request the data retrieved from a successful Subject Access Request ( SAR) in .csv or . SQL format?

this of course will enable easy porting into a relational database for interrogation 

SAR could be to any institution  

DE_612183

Not sure thats even possible - when I had a dsar done I had emails in .msg format, letters in pdf also some stuff in .doc etc.

I don't think you can ask them to convert data into another format for you - you can of course do this yourself.

DullGreyGuy

Erebos said:

Wondering if it’s possible, or do I have a right to request the data retrieved from a successful Subject Access Request ( SAR) in .csv or . SQL format?

this of course will enable easy porting into a relational database for interrogation 

SAR could be to any institution  

Anyone can ask anything they want but you cannot oblige them to provide it any particular format. 

I am curious how the hell you think SQL format would work? How'd a text file that says "Select * from CustTable Where UserIDstr = 'Erebos'" going to help you? It also wouldn't satisfy the SAR requirement of them providing the actual data they hold. 

eskbanker

ICO guidance to businesses is clear:

• If the individual submitted the SAR electronically (eg by email or via social media), you must provide a copy in a commonly used electronic format. You may choose the format, unless the requester makes a reasonable request for you to provide it in another commonly used format (electronic or otherwise).

[...]

What is a commonly used electronic format?

The UK GDPR does not define a “commonly used electronic format”. However, this means the format in which you supply the requester with their personal data. When determining what format to use, you should consider both the circumstances of the particular request and whether the individual has the ability to access the data you provide in that format.

[...]

Therefore, it is good practice to establish with the individual their preferred format, prior to fulfilling their request.

However, if you were to send the individual their information in an encrypted format, and then separately send them a secure code that they can use to access the encrypted information, you will have provided them with direct access to their data.

Alternatives can also include allowing the individual to access their data remotely and download a copy in an appropriate format. See ‘Do we need to provide remote access?’ for more information.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-should-we-supply-information-to-the-requester/

I'd suggest that this means that, if a SAR is sent electronically, asking for tabulated transactional data in .CSV format (for example) then that's not unreasonable and the ICO would expect the institution to comply.

However, it may not be so straightforward to expect other data to be formatted in that way, so much will depend on exactly which data are sought....

Erebos

DullGreyGuy said:

Erebos said:

Wondering if it’s possible, or do I have a right to request the data retrieved from a successful Subject Access Request ( SAR) in .csv or . SQL format?

this of course will enable easy porting into a relational database for interrogation 

SAR could be to any institution  

Anyone can ask anything they want but you cannot oblige them to provide it any particular format. 

I am curious how the hell you think SQL format would work? How'd a text file that says "Select * from CustTable Where UserIDstr = 'Erebos'" going to help you? It also wouldn't satisfy the SAR requirement of them providing the actual data they hold. 

To settle you curiosity:

The data I require is already iheld in a SQL database and in its current format I could querie this and use AI to interrogate the data.

if it’s sent as a pdf I’m sure you’ll know this does not respond well to queries 

that’s how the hell

eskbanker

Erebos said:

DullGreyGuy said:

Erebos said:

Wondering if it’s possible, or do I have a right to request the data retrieved from a successful Subject Access Request ( SAR) in .csv or . SQL format?

this of course will enable easy porting into a relational database for interrogation 

SAR could be to any institution  

Anyone can ask anything they want but you cannot oblige them to provide it any particular format. 

I am curious how the hell you think SQL format would work? How'd a text file that says "Select * from CustTable Where UserIDstr = 'Erebos'" going to help you? It also wouldn't satisfy the SAR requirement of them providing the actual data they hold. 

To settle you curiosity:

The data I require is already iheld in a SQL database and in its current format I could querie this and use AI to interrogate the data.

if it’s sent as a pdf I’m sure you’ll know this does not respond well to queries 

that’s how the hell

I could be wrong but suspect that the point was that SQL is a language (Structured Query Language) rather than a database format, despite the fact that many choose to use it to refer to Microsoft's proprietary database product, so a file in .SQL format will simply contain one or more queries, rather than the data that would be retrieved when executed on a database....

How do you know what the underlying native data format is, given the ancient legacy systems still used by many financial institutions?

Erebos

eskbanker said:

Erebos said:

DullGreyGuy said:

Erebos said:

Wondering if it’s possible, or do I have a right to request the data retrieved from a successful Subject Access Request ( SAR) in .csv or . SQL format?

this of course will enable easy porting into a relational database for interrogation 

SAR could be to any institution  

Anyone can ask anything they want but you cannot oblige them to provide it any particular format. 

I am curious how the hell you think SQL format would work? How'd a text file that says "Select * from CustTable Where UserIDstr = 'Erebos'" going to help you? It also wouldn't satisfy the SAR requirement of them providing the actual data they hold. 

To settle you curiosity:

The data I require is already iheld in a SQL database and in its current format I could querie this and use AI to interrogate the data.

if it’s sent as a pdf I’m sure you’ll know this does not respond well to queries 

that’s how the hell

I could be wrong but suspect that the point was that SQL is a language (Structured Query Language) rather than a database format, despite the fact that many choose to use it to refer to Microsoft's proprietary database product, so a file in .SQL format will simply contain one or more queries, rather than the data that would be retrieved when executed on a database....

How do you know what the underlying native data format is, given the ancient legacy systems still used by many financial institutions?

Because I’m in contact with the institution I know what they hold the data in.

 I was referring to .sql file which is exported from a relational database such as Microft SQL or comma separated .
both which I would prefer

eskbanker

Erebos said:

eskbanker said:

Erebos said:

DullGreyGuy said:

Erebos said:

Wondering if it’s possible, or do I have a right to request the data retrieved from a successful Subject Access Request ( SAR) in .csv or . SQL format?

this of course will enable easy porting into a relational database for interrogation 

SAR could be to any institution  

Anyone can ask anything they want but you cannot oblige them to provide it any particular format. 

I am curious how the hell you think SQL format would work? How'd a text file that says "Select * from CustTable Where UserIDstr = 'Erebos'" going to help you? It also wouldn't satisfy the SAR requirement of them providing the actual data they hold. 

To settle you curiosity:

The data I require is already iheld in a SQL database and in its current format I could querie this and use AI to interrogate the data.

if it’s sent as a pdf I’m sure you’ll know this does not respond well to queries 

that’s how the hell

I could be wrong but suspect that the point was that SQL is a language (Structured Query Language) rather than a database format, despite the fact that many choose to use it to refer to Microsoft's proprietary database product, so a file in .SQL format will simply contain one or more queries, rather than the data that would be retrieved when executed on a database....

How do you know what the underlying native data format is, given the ancient legacy systems still used by many financial institutions?

Because I’m in contact with the institution I know what they hold the data in.

Fair enough, although as above you did say in your original post that "SAR could be to any institution", suggesting a generic question rather than a specific one.

Curious about discussing underlying tech with an institution though, is this through their main customer service function, or data protection team, or just informal dialogue with a known contact, etc?

pochisoldi

What data are you asking for - transactions?

The objective is to get data in a format that can either be directly loaded into a database ("Look a unicorn!") or can be munged into an importable format.

The easiest route for this is to download CSV, QIF, or OFX files from online banking if available, with OFX and QIF being preferable to CSV.
OFX (SGML or XML) and QIF are easily parsed - write a program to do it for one institution, and it will work for most others using the same kind of file.

If they don't offer downloads, then I would request the information in "OFX, QIF, CSV, XML, JSON or other text format suitable for loading or processing for loading into a database. Please do not provide information in PDF format".

You could try asking or using a midata download, but as far as I can see it's an easily parsed CSV format that's stripped of useful information.

I was going to suggest trying to see if you can download a "midata" file from your institution, but a quick check of two financial institutions show that the data is in a semi consistent CSV format (data may or may not be contained in double quotes, one provider likes to stick a tab at the beginning of the third and subsequent lines, !!!!!!), but any payee information for standing orders, bank transfers in/out, is anonymised. For me it's as useful as an ashtray on a motorbike.