england-and-wales gdpr data-protection subject-access-request data-retention
SARing received text messages from a lost phone
<p>Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received.</p>
<p>Bob loses his phone but never recovers it yet would like to see any messages he may have been sent.</p>
<p>As evidenced above and under RIPA 2000, we know that his service provider has been storing all of his received messages even if he never gets back that particular SIM card.</p>
<p>Is Bob entitled to access the SMS that were sent to him?</p>

<p>The service provider has no obligation (unless by contract) to keep the <em>content</em> of SMS messages.</p>
<p>The service provider may keep content for a few hours or days, for circumstances such as unpowered phones. It will retain the <em>metadata</em> e.g. sender, recipient, date and time, and message type, for a longer period.</p>
<p>Bob should be able to obtain the metadata for his outgoing communications via SAR. But before resorting to a SAR, Bob should find out if his provider makes that information available via the customer support or customer account section of its website.</p>
<p>Bob will need a court order to obtain the metadata for his incoming communications.</p>
<p>The above is true for, at least, <a href="https://www.vodafone.co.uk/cs/groups/configfiles/documents/contentdocuments/vftst042750.pdf" rel="nofollow noreferrer">Vodafone</a>, <a href="https://www.o2.co.uk/help/safety-and-security/how-to-get-a-copy-of-the-information-we-store-about-you" rel="nofollow noreferrer">O2</a>, <a href="https://www.three.co.uk/termspdf/Right-of-Access-V5.pdf" rel="nofollow noreferrer">Three</a> and <a href="https://ee.co.uk/help/help-new/safety-and-security/protecting-your-information/how-can-i-request-my-personal-data" rel="nofollow noreferrer">EE</a>, each of which has published material specifically about this topic.</p>
