News for hackers. Stuff that matters.

A comment on No one’s ready for GDPR. Parent comment

Re:No one’s ready for GDPR by Cass on Wednesday May 23, 2018 @01:37PM (#17136151)
It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done.

Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

[ Parent | on HN ]
Re:No one’s ready for GDPR by 0xffff2 on Wednesday May 23, 2018 @01:46PM (#17136242)
1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)?

2) If you stick the original in the shredder, you are removing much more than just the requestor's data.

[ Parent | on HN ]
Re:No one’s ready for GDPR by jdietrich on Wednesday May 23, 2018 @02:55PM (#17137010)
>1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)?

You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately.

>2) If you stick the original in the shredder, you are removing much more than just the requestor's data.

There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged.

https://gdpr-info.eu/art-5-gdpr/

[ Parent | on HN ]
Re:No one’s ready for GDPR by thephyber on Wednesday May 23, 2018 @06:31PM (#17139012)
> Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

Sounds like a DDoS waiting to happen.

[ Parent | on HN ]