3 ms·

Yes. You then clearly have a "business need" (banning troublesome members), that clearly allows handling and storage of data. Hence "right to be deleted" does

Yes. You then clearly have a "business need" (banning troublesome members), that clearly allows handling and storage of data. Hence "right to be deleted" does not apply any more (or more correctly, it is overruled by a more specific right)... I work with a bank. They have a general 3 or 6 month rule for "non customers" and "ex customers" (i.e. 3-6 months after you are not a customer anymore you will be deleted by normal retention). If you are fraudulent, the retention interval is now 10 years! They have a full-time DPO who has spoken both to external legal council (he is a legal-trained person himself) and our local DPA.

svennek 8y ago
Also any kind of invoice data is by law (in Denmark) required to be kept for 5 full years after closing of the books. That also means you are not allowed to delete that data in that period due to the GDPR (as the accounting law overrules the other)
Someone 8y ago
For those reading along, it’s article 47 of the GDPR: ”The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is for the legislator to provide by law for the legal basis for public authorities to process personal data, that legal basis should not apply to the processing by public authorities in the performance of their tasks. The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” Note the explicit mentioning of “The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned”
japhyr 8y ago
This is a really interesting example for comparison. I think I could come up with a clear explanation of which data is kept, and for what purposes. A compliant user can have all of their data deleted upon request, with reasonable "are you sure" prompts. An abusive user will have evidence for abuse retained, and enough information to prevent spamming accounts.
merinowool 8y ago
What if a user you want to ban is not fraudulent, but a nuisance?
- svennek 8y ago
  That is not as clear cut, but if you have stated your thoughts and decisions you should be in the clear. The worst that would happen would be a letter from your DPA asking you to rectify sitation (and giving you more specific guidelines)...

svennek 8y ago

Also any kind of invoice data is by law (in Denmark) required to be kept for 5 full years after closing of the books. That also means you are not allowed to delete that data in that period due to the GDPR (as the accounting law overrules the other)

Someone 8y ago

For those reading along, it’s article 47 of the GDPR: ”The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is for the legislator to provide by law for the legal basis for public authorities to process personal data, that legal basis should not apply to the processing by public authorities in the performance of their tasks. The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” Note the explicit mentioning of “The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned”

japhyr 8y ago

This is a really interesting example for comparison. I think I could come up with a clear explanation of which data is kept, and for what purposes. A compliant user can have all of their data deleted upon request, with reasonable "are you sure" prompts. An abusive user will have evidence for abuse retained, and enough information to prevent spamming accounts.

merinowool 8y ago

What if a user you want to ban is not fraudulent, but a nuisance?

svennek 8y ago
That is not as clear cut, but if you have stated your thoughts and decisions you should be in the clear. The worst that would happen would be a letter from your DPA asking you to rectify sitation (and giving you more specific guidelines)...