4 ms·
Thanks for the link, it's very easy to read. I still have some questions about data deletion request: - How will this affect invoices that have to be kept for
by forgot-my-pw 8y ago
Thanks for the link, it's very easy to read. I still have some questions about data deletion request:
- How will this affect invoices that have to be kept for accounting purposes? Even if a customer wishes their data to be removed, we should not remove accounting information.
- How will this affect Internet archives and caches?
It seems removing all traces of a customer can be a very hard thing to do.
- dmitriid 8y agoIANAL If other laws exist that clash with GDPR, those laws take precedence. This question most often comes up specifically with regards to payments and finance. If a law requires you to retain payment/accounting information for three years, you must keep that info for three years, because this is addressed by a more specific law than GDPR.
- forgot-my-pw 8y agoThank you.
- michaelbuckbee 8y agoThere's two pieces of this here: 1. If you're legally obligated to keep information, you should keep it. This is one of the "legal bases" of handling personal data. Others are things like they consented to this, you have a legitimate business activity with it, they contracted you to do something with it, etc. 2. The GDPR makes a really clear distinction between personal information (email, name, religion, etc.) and everything else: you need to delete the personal information. So it's not necessary to do a cascading delete of everything the user ever created if they ask for their _personal_ information to be removed. This isn't really GDPR related, but you can see this on Reddit sometimes where comments that a user remain, but the user deleted their account.