3 ms·

Well, you're clearly thinking deeply about this and you seem to care. Which is great. I've been digging in deep on this the last few months so I have some thoug

Well, you're clearly thinking deeply about this and you seem to care. Which is great. I've been digging in deep on this the last few months so I have some thoughts. Respectfully (srsly), I think you might be misinterpreting the legislation (this resource is provides more concrete examples of how you should interpret it). For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. 17(2) states you must fwd this request on to other online orgs. 17(3) provides the exceptions for which a Controller can object to the erasure. It is important to note that the spirit of GDPR is one where Data Subjects rights (to their data, to object) are the default. Sort of like innocent until proven guilty. This is a big shift for most companies who would contend that they own the data & data exhaust from use of their application. As for compliance demonstration... yes, this is still a mess. My only suggestion there is that if you're working with software companies, try to study what the leaders are doing and take some inspiration. https://www.enterpriseready.io/gdpr/preparing-for-gdpr/ https://www.enterpriseready.io/gdpr/preparing-for-gdpr/ Happy to hear your thoughts. Genuinely interested in other people's perspectives on this.

Silhouette 8y ago
For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. Yes, but crucially, if the data is still relevant and you're processing it on a proper basis, the data subject doesn't necessarily have a right to have it erased. If your only legal basis for processing is consent, subjects get most of the rights under the GDPR automatically and you have very little choice about complying. One of the big changes in the new regime is that consent can be withdrawn retrospectively. If your basis is legitimate interests, things are more complicated. Subject rights are stronger in this situation than with some of the other legal bases, because they can object to processing. However, the right to object is itself subject to balancing tests that aren't clearly defined, except in the specific case of direct marketing. For the stronger bases, such as performance of a contract or compliance with legal obligations, subject rights are still quite limited even under the GDPR. For example, under EU VAT rules, we are required by law to keep evidence of where our customers are located for quite a long time, and customers can't require us to delete that evidence prematurely. There are some other important details to be considered, for example if you're processing data about children, but that seems to be the basic situation.

Silhouette 8y ago

For example, Article 17(1) lays out the MANY grounds upon which a Data Subject can request erasure. If ONE of the mentioned criteria is met including the very broad Right to Object (Article 21) then it must be erased. Yes, but crucially, if the data is still relevant and you're processing it on a proper basis, the data subject doesn't necessarily have a right to have it erased. If your only legal basis for processing is consent, subjects get most of the rights under the GDPR automatically and you have very little choice about complying. One of the big changes in the new regime is that consent can be withdrawn retrospectively. If your basis is legitimate interests, things are more complicated. Subject rights are stronger in this situation than with some of the other legal bases, because they can object to processing. However, the right to object is itself subject to balancing tests that aren't clearly defined, except in the specific case of direct marketing. For the stronger bases, such as performance of a contract or compliance with legal obligations, subject rights are still quite limited even under the GDPR. For example, under EU VAT rules, we are required by law to keep evidence of where our customers are located for quite a long time, and customers can't require us to delete that evidence prematurely. There are some other important details to be considered, for example if you're processing data about children, but that seems to be the basic situation.