european-union gdpr finland
GDPR - Do we need to give individual mixed personal data of 2 individuals? (Right of access)
<p>Individual is asking for phone recording which contains personal information of that individual and our marketing person, it also contains our sales speech. Do we need to provide copy of phone recording to the individual according to GDPR? 
(There might also be law which will prohibit it)</p>

<h1>Subject Access Request</h1>

<p>The dreaded SAR (§15 Right of access by the data subject) gives the company 30 days to give a full overview of personal data, the current state, how it is used, who has access, etc.</p>

<h1>Only person-identifying data</h1>

<p>It is easy to think that "personal" means all customer's data, but it's actually only person-identifying data that is regulated. You should not need to provide the log of calls, unless each call provides person-identifying data (not local to the system).</p>

<h1>Links to other's person-identifying data</h1>

<p>An example of other party information would be the bank's "Spouse" data. Out of a data minimisation (§5.1c) point of view you could argue that the bank does not need to know you're married, but for now say you need it. So the question is how much you need to know about spouse in the event of a SAR.<br>
Obviously the transaction and account details is not for you to see, but for the point of data correctness (§16 Right to rectification) you may need to know more than just the name to check that you have the right spouse. Disclosing the last digits of her social security number may fulfill the correctness check.</p>

<p>Right of access pertains to currently being processed data. If the data is in no way being processed there is no legal grounds for right of access. </p>

<p>If you are processing or were processing it in any way when the request was made then yes legally according to the GDPR you would have to provide it. You would also need to provide them with the reason it was or is being processed.</p>

<p>However being that GDPR only requires you to provide the personal data and nothing else. With that said you could in theory provide only the parts of the recording which contained personal data. However at that point in order to do so you would be processing the data again.</p>

<p>Depending on what consent you obtained from the person for the recording this could be a grey area.</p>
