gdpr
Does GDPR Recital 15 exempt unstructured electronic data?
<p><a href="https://gdpr-info.eu/recitals/no-15/" rel="noreferrer">GDPR Recital 15</a> states that </p>

<blockquote>
  <p>Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation.</p>
</blockquote>

<p>I have found <a href="https://www.gdprfaq.com/key-topics-1/2017/4/27/unstructured-data" rel="noreferrer">an interpretation</a> that claims </p>

<blockquote>
  <p>This recital seems to imply that unstructured data is not covered under GDPR, and hence is not subject to access requests. This would mean that any unstructured data should not be included in a data subject access request. </p>
</blockquote>

<p>Is this a reasonable conclusion for unstructured data such as message bodies in email archives?</p>

<p>No, in my opinion, <a href="https://gdpr-info.eu/recitals/no-15/" rel="nofollow noreferrer">Recital 15 GDPR</a> does not support the conclusion that unstructured electronic data, such as email message bodies, would be exempted from GDPR. </p>

<p>As indicated in the comments, the last sentence in Recital 15 refers to <em>physical</em> files or sets of files. This follows from the wording ("files or sets of files" and the reference to "cover pages") and is clear when looking at the translations (the german version refers to "Akten oder Aktensammlungen" and the french to "Les dossiers ou ensembles de dossiers"). </p>

<p>This interpretation is further supported by <a href="https://gdpr-info.eu/art-2-gdpr/" rel="nofollow noreferrer">Article 2(1) GDPR</a> which separates between "processing of personal data wholly or partly by automated means" and "processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system".</p>

<p>This means that, generally, electronically processed personal data is covered by the GDPR (irrespective of whether the processing is structured or not), and personal data in physical papers or files is only covered by the GDPR if it is structured (or intended to be structured).</p>

<p>2 &quot;The protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system.&quot; 3 &quot;Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation.&quot;</p>
<p>I do not see, why sentence 3 only applies to &quot;as well as to manual processing&quot; of sentence 2. To say so, is pure speculation and can be also interpreted differently.</p>
