3 ms·

I'm not a lawyer but I've read it fairly thoroughly. From the ico, the exceptions to the right to erasure are below (none of them cover your example): The righ

by abraae 8y ago

I'm not a lawyer but I've read it fairly thoroughly. From the ico, the exceptions to the right to erasure are below (none of them cover your example): The right to erasure does not apply if processing is necessary for one of the following reasons: to exercise the right of freedom of expression and information; to comply with a legal obligation; for the performance of a task carried out in the public interest or in the exercise of official authority; for archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing; or for the establishment, exercise or defence of legal claims.

lazyasciiart 8y ago
Ok, well here's the text of the legislation. Article 17.1 The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ If you read further down the page, you come to the section you are quoting, 17.3, which says that the above right from 17.1 does not apply even if one of the conditions in 17.1 is met. However the scenario we are talking about is one where none of those conditions were met in the first place, so we never had to look at 17.3. You can argue that 17.1.b/c would require an employer to remove any demographic/political data it had stored on you, but absolutely not that it requires the employer to remove the record of your existence at the company.
- abraae 8y ago
  Again, IANAL, but according to 17.1.b, the data subject..shall have the right to obtain from the controller the erasure of personal data concerning him or her ... where one of the following grounds applies: (17.1.b) the data subject withdraws consent on which the processing is based 17.1.b appears to be the trump card held by the data subject. They can withdraw consent at any time and request erasure. Once they do, the data controller can then use any of the exceptions in 17.3 to deny them. However none of these is "because I want to keep records of all firings". My further understanding is that you certainly could keep a record that someone was fired, just not a record that included any personal information that could identify who that was. i.e. pseudonymization..
  - lazyasciiart 8y ago
    No, I addressed that. 17.1.b doesn't cover identifying data, it covers data about their characteristics. That's what my last sentence was about - you can demand that they remove the information that you are black, but not that they remove the information that you were there. (edit - and I think you could keep the information about their race/etc if it was properly pseudonymized, but I haven't tried working that out so I'm not sure).

by abraae 8y ago

lazyasciiart 8y ago

Ok, well here's the text of the legislation. Article 17.1 The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ If you read further down the page, you come to the section you are quoting, 17.3, which says that the above right from 17.1 does not apply even if one of the conditions in 17.1 is met. However the scenario we are talking about is one where none of those conditions were met in the first place, so we never had to look at 17.3. You can argue that 17.1.b/c would require an employer to remove any demographic/political data it had stored on you, but absolutely not that it requires the employer to remove the record of your existence at the company.

abraae 8y ago
Again, IANAL, but according to 17.1.b, the data subject..shall have the right to obtain from the controller the erasure of personal data concerning him or her ... where one of the following grounds applies: (17.1.b) the data subject withdraws consent on which the processing is based 17.1.b appears to be the trump card held by the data subject. They can withdraw consent at any time and request erasure. Once they do, the data controller can then use any of the exceptions in 17.3 to deny them. However none of these is "because I want to keep records of all firings". My further understanding is that you certainly could keep a record that someone was fired, just not a record that included any personal information that could identify who that was. i.e. pseudonymization..
- lazyasciiart 8y ago
  No, I addressed that. 17.1.b doesn't cover identifying data, it covers data about their characteristics. That's what my last sentence was about - you can demand that they remove the information that you are black, but not that they remove the information that you were there. (edit - and I think you could keep the information about their race/etc if it was properly pseudonymized, but I haven't tried working that out so I'm not sure).