4 ms·

You are responsible to everyone who you have data about, regardless of whether or not they are your user. If I use your service to store a photo of my mom, you

by s17n 9y ago

You are responsible to everyone who you have data about, regardless of whether or not they are your user. If I use your service to store a photo of my mom, you now have a legal obligation to her even though you don't even know she exists. Any text that you store, you are required to know who is mentioned in it and give them tools for download, right to be forgotten, etc.

realusername 9y ago
> You are responsible to everyone who you have data about, regardless of whether or not they are your user. We have zero data on non-users so this part is not relevant to us, like I said it's not a data-gathering company. For the tools to download, remove data, consent... That's what I meant with that one or two weeks worth of work.
Aengeuad 9y ago
What you are suggesting would not only make compliance of GDPR impossible for any company that accepts any form of user submitted data, it would also violate the privacy of the users submitting said data. If I, party A, send a message to party B that happens to contain information about party C, party C does not get to see the messages between parties A and B just because it concerns them or has personally identifying information about them.
- dogma1138 9y ago
  Actually under GDPR they do you need to perform data discovery to identify that data. https://enterprise.microsoft.com/en-gb/articles/roles/discover-gdpr/ https://enterprise.microsoft.com/en-gb/articles/roles/discov... GDPR does not cover only data you collect through your primary business model but ALL DATA defined as Personal Information under the GDPR.
  - AstralStorm 9y ago
    Not really true, unless it was explicitly submitted as protected data. What toy have to doo is to provide a way to scrub accidental data leaks. I'm thinking cases like "someone posted a picture of their friend with a cat on your site". Not explicitly labelled "send in a photo of yourself". Or if someone posted another's address. You should respond to it at least in request, preferably earlier. The discovery service is mostly to help people transition by checking their third party operators if they do not know who that is.
marcus_holmes 9y ago
this isn't true. Because it's not personally identifiable information. If I take a photo of a crowd of people and upload it to a cloud service, that does not create an obligation on either me or the cloud service to identify all those people and give them to opportunity to opt out (or in). I own the copyright of photos I take. I don't need permission from people to take their photo in a public space. They have no right to ask me to delete the photo or remove their face from any photo that includes them. Even if I store it on a computer. If I provide a service that identifies all the people in a photo, then I am storing personally-identifiable information and I need to give the person I have identified the opportunity to remove their data from my system. That doesn't mean removing their face from the photo, but does mean removing the data that allowed me to identify them in the photo. There's a difference.
- s17n 9y ago
  All I know is that my company stores image data and we don' do any face recognition but the lawyers say that to comply we need to start removing faces.
  - marcus_holmes 9y ago
    that's interesting. Do they say why?
    - s17n 9y ago
      Because faces are personal information under the gdpr.
      - AstralStorm 9y ago
        Why? You do not know which user uploaded which picture? Accidental uploads of private data by the user are perfectly fine in terms of GDPR but you must allow for these to be removed on request. If you automatically scrub them it is good, but you do not really have to do that. Telling the user how any pictures will be used and how to get rid of them is enough.

by s17n 9y ago

realusername 9y ago

> You are responsible to everyone who you have data about, regardless of whether or not they are your user. We have zero data on non-users so this part is not relevant to us, like I said it's not a data-gathering company. For the tools to download, remove data, consent... That's what I meant with that one or two weeks worth of work.

Aengeuad 9y ago

What you are suggesting would not only make compliance of GDPR impossible for any company that accepts any form of user submitted data, it would also violate the privacy of the users submitting said data. If I, party A, send a message to party B that happens to contain information about party C, party C does not get to see the messages between parties A and B just because it concerns them or has personally identifying information about them.

dogma1138 9y ago
Actually under GDPR they do you need to perform data discovery to identify that data. https://enterprise.microsoft.com/en-gb/articles/roles/discover-gdpr/ https://enterprise.microsoft.com/en-gb/articles/roles/discov... GDPR does not cover only data you collect through your primary business model but ALL DATA defined as Personal Information under the GDPR.
- AstralStorm 9y ago
  Not really true, unless it was explicitly submitted as protected data. What toy have to doo is to provide a way to scrub accidental data leaks. I'm thinking cases like "someone posted a picture of their friend with a cat on your site". Not explicitly labelled "send in a photo of yourself". Or if someone posted another's address. You should respond to it at least in request, preferably earlier. The discovery service is mostly to help people transition by checking their third party operators if they do not know who that is.

marcus_holmes 9y ago

this isn't true. Because it's not personally identifiable information. If I take a photo of a crowd of people and upload it to a cloud service, that does not create an obligation on either me or the cloud service to identify all those people and give them to opportunity to opt out (or in). I own the copyright of photos I take. I don't need permission from people to take their photo in a public space. They have no right to ask me to delete the photo or remove their face from any photo that includes them. Even if I store it on a computer. If I provide a service that identifies all the people in a photo, then I am storing personally-identifiable information and I need to give the person I have identified the opportunity to remove their data from my system. That doesn't mean removing their face from the photo, but does mean removing the data that allowed me to identify them in the photo. There's a difference.

s17n 9y ago
All I know is that my company stores image data and we don' do any face recognition but the lawyers say that to comply we need to start removing faces.
- marcus_holmes 9y ago
  that's interesting. Do they say why?
  - s17n 9y ago
    Because faces are personal information under the gdpr.
    - AstralStorm 9y ago
      Why? You do not know which user uploaded which picture? Accidental uploads of private data by the user are perfectly fine in terms of GDPR but you must allow for these to be removed on request. If you automatically scrub them it is good, but you do not really have to do that. Telling the user how any pictures will be used and how to get rid of them is enough.