No one’s ready for GDPR

Re:No one’s ready for GDPR by jamescostian on Wednesday May 23, 2018 @01:27PM (#17136042)

GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't see your data in a machine-readable format or delete it.

[ Parent | on HN ]

Re:No one’s ready for GDPR by Cass on Wednesday May 23, 2018 @01:37PM (#17136151)

It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done.

Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

[ Parent | on HN ]

Re:No one’s ready for GDPR by 0xffff2 on Wednesday May 23, 2018 @01:46PM (#17136242)

1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)?

2) If you stick the original in the shredder, you are removing much more than just the requestor's data.

[ Parent | on HN ]

Re:No one’s ready for GDPR by jdietrich on Wednesday May 23, 2018 @02:55PM (#17137010)

>1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)?

You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately.

>2) If you stick the original in the shredder, you are removing much more than just the requestor's data.

There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged.

https://gdpr-info.eu/art-5-gdpr/

[ Parent | on HN ]

Re:No one’s ready for GDPR by thephyber on Wednesday May 23, 2018 @06:31PM (#17139012)

> Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

Sounds like a DDoS waiting to happen.

[ Parent | on HN ]

Re:No one’s ready for GDPR by donogh on Wednesday May 23, 2018 @01:48PM (#17136281)

It does not have to be machine readable. GDPR is technologically neutral. If the medium of storage is paper, a data subject access request can be fulfilled on paper. For example, photocopy the page, redact the other names, and mail the copy to the data subject.

If the data subject access request is sent by email, you can take it a step further and scan and email that page. Still, it does not have to be machine readable.

[ Parent | on HN ]

Re:No one’s ready for GDPR by jamescostian on Wednesday May 23, 2018 @02:02PM (#17136420)

Can you point me to the text in the GDPR says what you are saying? IANAL and there's a good chance I'm just misreading the GDPR, but doesn't Article 20[0] completely disagree with you? In addition, imagine the person with the guest list lost the password to their email after putting you on their guest list, and now you don't have their new email address to ask them for the data

[0] https://gdpr-info.eu/art-20-gdpr/

[ Parent | on HN ]

Re:No one’s ready for GDPR by donogh on Thursday May 24, 2018 @06:46AM (#17142746)

That's the right to data portability, which is your right to have your data with an electronic service transferred to another service in a machine readable format.

It has nothing to do with data subject access requests, which is encoded in Article 15: https://gdpr-info.eu/art-15-gdpr/

"Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form."

That does not mean machine readable.

[ Parent | on HN ]

Re:No one’s ready for GDPR by jInFluxx on Wednesday May 23, 2018 @02:15PM (#17136542)

1(b) of article 20 clarifies that it had to be machine readable where:

the processing is carried out by automated means.

[ Parent | on HN ]

Re:No one’s ready for GDPR by pwinnski on Wednesday May 23, 2018 @01:52PM (#17136315)

If you run a hotel, you can presumably answer the phone, and a photocopier and a dark pen should be enough to comply with reporting and deletion requirements.

[ Parent | on HN ]

Re:No one’s ready for GDPR by the_mitsuhiko on Wednesday May 23, 2018 @01:36PM (#17136142)

There are limits to which data can be requested to be deleted.

[ Parent | on HN ]