3 ms·
Just remember there is a "go away†, this request is too onerous" get-out clause for GDPR requests. Just as there is a billable option for excessive queries. Bo
by oliwarner 9y ago
Just remember there is a "go away†, this request is too onerous" get-out clause for GDPR requests. Just as there is a billable option for excessive queries.
Both options have to be reasoned —and the person making the request and squeal off to the ICO at any point— but in a letter like the linked one, I would find it hard to justify forensically picking through years of historical access data and not charge a fee for doing so.
Compliance regarding breach notification is forward-looking too, so all this nonsense about "has this ever happened" is outside the GDPR, as far as I can see, anyway.
† The GDPR contains no rules about being polite. If somebody made demands like this at me, I would be considerably less polite than my example there.
- mindslight 9y ago> hard to justify forensically picking through years of historical access data If querying is so onerous, then why the fuck are years of historical access data even being stored ? This desire to keep reams of nebulously categorized surveillance data "just in case" seems to be one of the issues at the heart of this legislation. If it has business value and a legitimate purpose, then formalize it. Otherwise, delete it.
- oliwarner 9y agoObviously, most people might not but some will. In some countries and sectors it's a legal or contractual requirement that you keep audit trails for x years. I've worked on accounting systems where the insurers and banks have both had separare requirements here. Not that this is relevant here. My point was that if people demand retroactive notice of a breach —and you're not otherwise required to notify them— even if you have that data, you can tell them to bugger off.
- moduspol 9y agoWhat about backups? And isn't it good practice for them to be immutable? Or is that outside of scope?