4 ms·

I haven't really dug into it being in the USA, but from what I've heard the big takeaway for my clients might be: "You can never again accept a European as a pa

I haven't really dug into it being in the USA, but from what I've heard the big takeaway for my clients might be: "You can never again accept a European as a patient, and for your own protection you might need to dismiss any European patients you have." I'm not really worried about legitimate cases where someone wants their data removed, as that seems unlikely. I'm less sure about the risks of some enterprising young lawyer over there finding a way (or a possible way that would end up thrown out) to leverage it to extort money. Read at its bluntest, as I understand it this law seems to basically ban backups, at least those retained for any significant amount of time. Have a customer/patient database on a cycle of daily/weekly/monthly backups that get pruned as they get older? You need to be able to purge any individual who requests it from those backups. Have regulatory or contractual requirements on keeping records? Well, that's what the courts are for, hope you like the attorneys you're going to be paying. Heck, for medical practices I've heard of insurance companies doing clawbacks of payments years after the date of service - what does a practice do if it serves a European with temporary insurance, gets a request to purge that person's data, then gets a request for clarification from an insurance company? Perhaps this is a complete non-issue for US companies, but I'm not so certain of that that I'd be willing to just dismiss it out of hand and if it's not dismissed then parts of it are pretty scary.

geocar 9y ago
I’m currently doing GDPR consulting for an American company. The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. If payment processing stays open for years, then years is fine. I have a customer who keeps data for ten years. The GDPR doesn’t say that a European can claim “right to be forgotten” and force you to destroy invoices proving you did Work for hire. If for some reason they want you to stop processing (right to object) then they end up owing the money themselves- since they can’t force you to forget the invoice, having you unable to send their invoice to insurance sounds like a bad move on their part. Reading the GDPR “at its bluntest” is not the correct way to do things: European courts are not amused by a narrow view of the law when it is used to argue something is technically legal, not do they use their maximum force for minor infraction. That’s why you don’t need to worry about an “enterprising” European taking you to the cleaners because the courts won’t think it’s funny either. It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing.
- Silhouette 9y ago
  The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. Reading the GDPR “at its bluntest” is not the correct way to do things And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing. Nope, because the right to erasure is not negated because of those sorts of common sense, only specific criteria listed explicitly in the GDPR. And as things stand right now, that right to erasure immediately runs into all the issues of uncertainty raised by many in this discussion and other forums.
  - geocar 9y ago
    > And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. If the blocks are deduplicated because the reference count of the bit map remains greater than one then I don't see the problem: Just because John Smith can ask you to delete him from your database doesn't mean he can ask you to delete all John Smiths. Also: European courts aren't amused by this kind of nonsense. > And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. Sure you can. You can look to the historical application of various other similar laws and get an idea of what the regulators are likely to do. For what it's worth: European courts cannot be legally bound to do anything. If they think you're being an asshole but are "technically within the law" they'll still fine you. That's just how it works here: Hurting people is simply not ok. > Nope, because the right to erasure is not negated because of those sorts of common sense It's not "common sense" at all: Being afraid of the government and the police isn't something civilised countries have to deal with. Why would anyone think that the government is trying to hurt people if everyone agrees hurting people is not okay?
smu 9y ago
An invoice is either a contractual or legal obligation, which takes precedence over the data subject rights. Even if you are asked to destroy the subject personal information, that information should never be included and is against the law.

geocar 9y ago

I’m currently doing GDPR consulting for an American company. The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. If payment processing stays open for years, then years is fine. I have a customer who keeps data for ten years. The GDPR doesn’t say that a European can claim “right to be forgotten” and force you to destroy invoices proving you did Work for hire. If for some reason they want you to stop processing (right to object) then they end up owing the money themselves- since they can’t force you to forget the invoice, having you unable to send their invoice to insurance sounds like a bad move on their part. Reading the GDPR “at its bluntest” is not the correct way to do things: European courts are not amused by a narrow view of the law when it is used to argue something is technically legal, not do they use their maximum force for minor infraction. That’s why you don’t need to worry about an “enterprising” European taking you to the cleaners because the courts won’t think it’s funny either. It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing.

Silhouette 9y ago
The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. Reading the GDPR “at its bluntest” is not the correct way to do things And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing. Nope, because the right to erasure is not negated because of those sorts of common sense, only specific criteria listed explicitly in the GDPR. And as things stand right now, that right to erasure immediately runs into all the issues of uncertainty raised by many in this discussion and other forums.
- geocar 9y ago
  > And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. If the blocks are deduplicated because the reference count of the bit map remains greater than one then I don't see the problem: Just because John Smith can ask you to delete him from your database doesn't mean he can ask you to delete all John Smiths. Also: European courts aren't amused by this kind of nonsense. > And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. Sure you can. You can look to the historical application of various other similar laws and get an idea of what the regulators are likely to do. For what it's worth: European courts cannot be legally bound to do anything. If they think you're being an asshole but are "technically within the law" they'll still fine you. That's just how it works here: Hurting people is simply not ok. > Nope, because the right to erasure is not negated because of those sorts of common sense It's not "common sense" at all: Being afraid of the government and the police isn't something civilised countries have to deal with. Why would anyone think that the government is trying to hurt people if everyone agrees hurting people is not okay?

smu 9y ago

An invoice is either a contractual or legal obligation, which takes precedence over the data subject rights. Even if you are asked to destroy the subject personal information, that information should never be included and is against the law.