3 ms·

It’s easy, but poses massive problems in the public sector or finance. Say you’re terrible at paying your dept, but manage to do so 10 years late. Now your tra

It’s easy, but poses massive problems in the public sector or finance. Say you’re terrible at paying your dept, but manage to do so 10 years late. Now your transaction is complete and you have the right to be forgotten, but I wouldn’t want to ever lend you money again. How do I keep that record?

number6 9y ago
You take Art 6 (f) of the GDPR. You write down that your processing is necessary for the purposes of the legitimate interests pursued by you. E.g. I don't want to lend money to a you ever again. But to identify you and not mistake you for someone I need to keep information like Name, Passportnumber and a reason why I put you on the list in first place. Now you can keep these information.
- icebraining 9y ago
  But the important point: you can only use that information for that purpose. No "oh well, now that we can keep it, let's use it for marketing and such".
  - number6 9y ago
    Good point! Looking at Recital 50 there may be possibility to use information for other than the original purpose if the new purpose is compatible. But another interesting thought: Can Marketing hold as a legitimate interest? Lets look at Recital 47: The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. Interseting finding you think. Reading this again the word may is striking. Ok this is not a Carte Blance. And since there is Recital 70 which states: "Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information." So where does this leave us: Yeah we can use Data for Marketing and it well may be a legitimate interest of a company. But we will have to inform the data subject that it can object the usage.
    - icebraining 9y ago
      Yeah, not really. Recital 47 says "may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding". If I ask to be forgotten, my interest is that my data is no longer used, and your legitimate interest in holding on to it to avoid lending to me in the future does not override that for any other purpose.
      - number6 9y ago
        That is right, and I guess it would count as objection to marketing.
- eksemplar 9y ago
  Well, what about stuff like this: http://www.bbc.com/news/technology-43752344 http://www.bbc.com/news/technology-43752344

number6 9y ago

You take Art 6 (f) of the GDPR. You write down that your processing is necessary for the purposes of the legitimate interests pursued by you. E.g. I don't want to lend money to a you ever again. But to identify you and not mistake you for someone I need to keep information like Name, Passportnumber and a reason why I put you on the list in first place. Now you can keep these information.

icebraining 9y ago
But the important point: you can only use that information for that purpose. No "oh well, now that we can keep it, let's use it for marketing and such".
- number6 9y ago
  Good point! Looking at Recital 50 there may be possibility to use information for other than the original purpose if the new purpose is compatible. But another interesting thought: Can Marketing hold as a legitimate interest? Lets look at Recital 47: The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. Interseting finding you think. Reading this again the word may is striking. Ok this is not a Carte Blance. And since there is Recital 70 which states: "Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information." So where does this leave us: Yeah we can use Data for Marketing and it well may be a legitimate interest of a company. But we will have to inform the data subject that it can object the usage.
  - icebraining 9y ago
    Yeah, not really. Recital 47 says "may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding". If I ask to be forgotten, my interest is that my data is no longer used, and your legitimate interest in holding on to it to avoid lending to me in the future does not override that for any other purpose.
    - number6 9y ago
      That is right, and I guess it would count as objection to marketing.
eksemplar 9y ago
Well, what about stuff like this: http://www.bbc.com/news/technology-43752344 http://www.bbc.com/news/technology-43752344