The Nightmare Letter: A Subject Access Request Under GDPR

Re:The Nightmare Letter: A Subject Access Request Under GDPR by x0x0 on Saturday March 17, 2018 @03:14PM (#16608527)

Then you haven't thought it through or don't understand the gdpr.

Though this letter doesn't mention it, you not only have to provide all data in your systems -- every single db inside your company -- but also data from every 3rd party system. Your transactional emailer, your marketing emailer, your billing system, your logging system, your retargeting system, etc.

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by jodrellblank on Saturday March 17, 2018 @06:54PM (#16609476)

Good. Stop casually aerosolizing information about your customers all over the cloud, and ignoring employees casually copying live databases here there and everywhere.

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by avianlyric on Saturday March 17, 2018 @03:26PM (#16608584)

That’s not totally true. GDPR only applies if the data is stored in an “filing system”. Things like logs almost certainly don’t fall under that. (Unless you where feeding them into a data mining system, that would change things)

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by x0x0 on Saturday March 17, 2018 @03:55PM (#16608759)

Believe whatever you want but (1) our lawyers disagree; (2) if you can query your logs, you have to (PS: you can; that's literally the point of things like sumologic); (3) the various privacy orgs that have published reasonable amounts of guidance -- notably ICO and DPC -- disagree.

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by web007 on Sunday March 18, 2018 @02:40AM (#16610722)

If you ever log an email address then logs contain PII, and are therefore in scope.

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by r00fus on Sunday March 18, 2018 @02:12PM (#16613321)

So why not log just username or transaction id?

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by sobani on Monday March 19, 2018 @04:14AM (#16616798)

Because usernames are PII under de GDPR too.

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by r00fus on Monday March 19, 2018 @12:35PM (#16619790)

True, but hidden IDs like the row GUID of the user are not, are they? They should be considered more like pseudonymous data[1] as they're meaningless outside the dataset.

[1] https://www.whitecase.com/publications/article/chapter-5-key...

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by dominotw on Saturday March 17, 2018 @03:55PM (#16608758)

Are you sure about logs? Kafka is in scope afaik.

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by Someone on Saturday March 17, 2018 @05:40PM (#16609208)

I think so, too. Certainly, they should be in scope for the “data protection” part, or (extreme example) you would be allowed to log personal data to a publicly visible server.

[ Parent | on HN ]

Re:The Nightmare Letter: A Subject Access Request Under GDPR by avianlyric on Saturday March 17, 2018 @09:28PM (#16610046)

To be clear, when I say GDPR doesn’t apply. I’m taking about information requests (the topic of the linked article).

The data protection part of GDPR of course applies to all PII regardless of how it’s stored. But that part is not new in GDPR, the EU has had strong data protection laws for a while. (Even if people didn’t talk about it)

[ Parent | on HN ]