4 ms·

You are legally required to retain payment history anyways for many years. So that's out of the GDPR scope.

jacquesm 9y ago
No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.
- detaro 9y ago
  GDPR explicitly lists processing that is necessarily to fulfill legal obligations by european or local law as permitted without further permission and as a reason to deny a deletion request, that covers at least a lot of it. (although you still have to report your use to the user and follow general guidelines on handling sensitive data of course)
  - jacquesm 9y ago
    So, it is in scope, since it is covered by the law, and then the law explicitly gives you permission to make an exception. But you'd better do all of the following: - have a legally trained person review your eventual solution and your reasoning behind it - document the exceptions, which laws and which datums it covers - keep track of the law as it changes, especially with new bodies of law such as the GDPR you can expect updates to reflect the situation on the ground and in a way the GDPR itself is such a change. - be prepared to review the situation/code if the law changes in the future - be aware that 'data retention' laws are very different from one industry to another (for instance telecommunications is a totally different beast than e-commerce)
- X4lldux 9y ago
  point b of Article 17(1) of GDPR specifically says: (...) and where there is no other legal ground for the processing; Compliance with tax & financial regulations counts as a "legal ground". But that doesn't mean companies can retain all of the email history.
  - jacquesm 9y ago
    Exactly, you need to make this decision on a per-data item level. Financial transactions are at a different level than other customer interactions, and whatever the local laws for retention of accounting data state is what you will have to mark very explicitly as exempt. This can get quite complicated, moreso if a company deals with both consumers and companies as customers.

No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.

detaro 9y ago
GDPR explicitly lists processing that is necessarily to fulfill legal obligations by european or local law as permitted without further permission and as a reason to deny a deletion request, that covers at least a lot of it. (although you still have to report your use to the user and follow general guidelines on handling sensitive data of course)
- jacquesm 9y ago
  So, it is in scope, since it is covered by the law, and then the law explicitly gives you permission to make an exception. But you'd better do all of the following: - have a legally trained person review your eventual solution and your reasoning behind it - document the exceptions, which laws and which datums it covers - keep track of the law as it changes, especially with new bodies of law such as the GDPR you can expect updates to reflect the situation on the ground and in a way the GDPR itself is such a change. - be prepared to review the situation/code if the law changes in the future - be aware that 'data retention' laws are very different from one industry to another (for instance telecommunications is a totally different beast than e-commerce)
X4lldux 9y ago
point b of Article 17(1) of GDPR specifically says: (...) and where there is no other legal ground for the processing; Compliance with tax & financial regulations counts as a "legal ground". But that doesn't mean companies can retain all of the email history.
- jacquesm 9y ago
  Exactly, you need to make this decision on a per-data item level. Financial transactions are at a different level than other customer interactions, and whatever the local laws for retention of accounting data state is what you will have to mark very explicitly as exempt. This can get quite complicated, moreso if a company deals with both consumers and companies as customers.