7 ms·

> Things like publicly visible visitors books are outlawed Does this mean the quaint guest book visitors could sign at the hotel I stayed in a couple weeks ago

> Things like publicly visible visitors books are outlawed Does this mean the quaint guest book visitors could sign at the hotel I stayed in a couple weeks ago would be illegal under the GDPR?

kerrsclyde 8y ago
We have been told so, if you are publicly displaying personal information about an individual without their permission. Of course their are ways around this, using a single sheet for each person for example.
guitarbill 8y ago
FFS, no. It's optional, you volunteered the data, and the data is used for it's intended purposes. This is still fine. (What wouldn't be fine is scraping the guest book, and then using that info)
- jamescostian 8y ago
  GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't see your data in a machine-readable format or delete it.
  - the_mitsuhiko 8y ago
    There are limits to which data can be requested to be deleted.
  - Cass 8y ago
    It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done. Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?
    - 0xffff2 8y ago
      1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.
      - jdietrich 8y ago
        >1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
    - thephyber 8y ago
      > Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically? Sounds like a DDoS waiting to happen.
  - donogh 8y ago
    It does not have to be machine readable. GDPR is technologically neutral. If the medium of storage is paper, a data subject access request can be fulfilled on paper. For example, photocopy the page, redact the other names, and mail the copy to the data subject. If the data subject access request is sent by email, you can take it a step further and scan and email that page. Still, it does not have to be machine readable.
    - jamescostian 8y ago
      Can you point me to the text in the GDPR says what you are saying? IANAL and there's a good chance I'm just misreading the GDPR, but doesn't Article 20[0] completely disagree with you? In addition, imagine the person with the guest list lost the password to their email after putting you on their guest list, and now you don't have their new email address to ask them for the data [0] https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/
      - jInFluxx 8y ago
        1(b) of article 20 clarifies that it had to be machine readable where: the processing is carried out by automated means.
      - donogh 8y ago
        That's the right to data portability, which is your right to have your data with an electronic service transferred to another service in a machine readable format. It has nothing to do with data subject access requests, which is encoded in Article 15: https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ "Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form." That does not mean machine readable.
  - pwinnski 8y ago
    If you run a hotel, you can presumably answer the phone, and a photocopier and a dark pen should be enough to comply with reporting and deletion requirements.
existencebox 8y ago
Disclaimers, although I was responsible for implementing GDPR for a subsection of a bigCo, I am not a lawyer, do not speak for my company, etc. I've just been getting increasingly annoyed by the amount if misinformation on both sides of the GDPR debate, (that it's both a straight good or a straight bad) even in sister comments to this, that I figured I'd try and give a Real Answer to your question. They would need to provide functionality such that an EU resident could request timely export and deletion of any records belonging to them in that guestbook. If your guestbook is physical and substantial, this may be limiting without additional systems, but GDPR also is rather vague in the pushback you're allowed to give if you're completing the export with best intentions, so this will likely not be settled until precedent occurs; this will be even more grey-area due to considerations of "ease of access" of the information in question, and other "softer" considerations. So to answer your question more bluntly: Without the bare minimum of a business process for someone to call up and say "I want to export/delete my entry in your guestbook" I'd say the experts who guided my team would probably agree that the business owner should err on the side of assuming non-compliance, so long as you don't reasonably preclude EU visitors.
- 0xffff2 8y ago
  Can you clarify how your entire response is substantially different in any way from the single word "maybe"?
  - existencebox 8y ago
    "maybe" doesn't detail the steps you could take to bring yourself into compliance, doesn't describe the specific decision points that put you at risk, and doesn't describe how the "maybe" ever resolves to a hard "yes or no" I've given you the benefit of the doubt in answering this honestly but I don't think you read my initial response charitably.
- donogh 8y ago
  I would say that you could provide a notice specifying that signing the guestbook also constitutes consent to the public display of the person's name. If you want to take it further, you could ask them to submit a small form confirming their consent. Worst case, you redact their name -- use a marker! -- and document that process as part of your data review. Either way, it's complete overkill. It's not about following the letter of the law; it's about the spirit of the law. No one is going to get sued or fined for providing a public guest book.
r3bl 8y ago
Absolutely not. At best, you can challenge them to remove the page with your contribution to the guest book.
- Spearchucker 8y ago
  TipEx would do, and you could preserve the page.
  - 0xffff2 8y ago
    TipEx == White Out for other US residents. (I had to look it up.)
deleted 8y ago
[deleted]
PeterisP 8y ago
As far as I'm aware, GDPR doesn't make any new prohibitons in this regard - however, it's quite plausible that they were already technically forbidden for years by the earlier data privacy laws, but simply most organizations didn't pay much attention to them.
wbeckler 8y ago
Recital 15 of the GDPR states that it only applies "to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system." So if you don't file the sign in book, it's out of scope of the GDPR.

> Things like publicly visible visitors books are outlawed Does this mean the quaint guest book visitors could sign at the hotel I stayed in a couple weeks ago would be illegal under the GDPR?

kerrsclyde 8y ago

We have been told so, if you are publicly displaying personal information about an individual without their permission. Of course their are ways around this, using a single sheet for each person for example.

guitarbill 8y ago

FFS, no. It's optional, you volunteered the data, and the data is used for it's intended purposes. This is still fine. (What wouldn't be fine is scraping the guest book, and then using that info)

jamescostian 8y ago
GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't see your data in a machine-readable format or delete it.
- the_mitsuhiko 8y ago
  There are limits to which data can be requested to be deleted.
- Cass 8y ago
  It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done. Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?
  - 0xffff2 8y ago
    1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.
    - jdietrich 8y ago
      >1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
  - thephyber 8y ago
    > Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically? Sounds like a DDoS waiting to happen.
- donogh 8y ago
  It does not have to be machine readable. GDPR is technologically neutral. If the medium of storage is paper, a data subject access request can be fulfilled on paper. For example, photocopy the page, redact the other names, and mail the copy to the data subject. If the data subject access request is sent by email, you can take it a step further and scan and email that page. Still, it does not have to be machine readable.
  - jamescostian 8y ago
    Can you point me to the text in the GDPR says what you are saying? IANAL and there's a good chance I'm just misreading the GDPR, but doesn't Article 20[0] completely disagree with you? In addition, imagine the person with the guest list lost the password to their email after putting you on their guest list, and now you don't have their new email address to ask them for the data [0] https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/
    - jInFluxx 8y ago
      1(b) of article 20 clarifies that it had to be machine readable where: the processing is carried out by automated means.
    - donogh 8y ago
      That's the right to data portability, which is your right to have your data with an electronic service transferred to another service in a machine readable format. It has nothing to do with data subject access requests, which is encoded in Article 15: https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ "Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form." That does not mean machine readable.
- pwinnski 8y ago
  If you run a hotel, you can presumably answer the phone, and a photocopier and a dark pen should be enough to comply with reporting and deletion requirements.

existencebox 8y ago

Disclaimers, although I was responsible for implementing GDPR for a subsection of a bigCo, I am not a lawyer, do not speak for my company, etc. I've just been getting increasingly annoyed by the amount if misinformation on both sides of the GDPR debate, (that it's both a straight good or a straight bad) even in sister comments to this, that I figured I'd try and give a Real Answer to your question. They would need to provide functionality such that an EU resident could request timely export and deletion of any records belonging to them in that guestbook. If your guestbook is physical and substantial, this may be limiting without additional systems, but GDPR also is rather vague in the pushback you're allowed to give if you're completing the export with best intentions, so this will likely not be settled until precedent occurs; this will be even more grey-area due to considerations of "ease of access" of the information in question, and other "softer" considerations. So to answer your question more bluntly: Without the bare minimum of a business process for someone to call up and say "I want to export/delete my entry in your guestbook" I'd say the experts who guided my team would probably agree that the business owner should err on the side of assuming non-compliance, so long as you don't reasonably preclude EU visitors.

0xffff2 8y ago
Can you clarify how your entire response is substantially different in any way from the single word "maybe"?
- existencebox 8y ago
  "maybe" doesn't detail the steps you could take to bring yourself into compliance, doesn't describe the specific decision points that put you at risk, and doesn't describe how the "maybe" ever resolves to a hard "yes or no" I've given you the benefit of the doubt in answering this honestly but I don't think you read my initial response charitably.
donogh 8y ago
I would say that you could provide a notice specifying that signing the guestbook also constitutes consent to the public display of the person's name. If you want to take it further, you could ask them to submit a small form confirming their consent. Worst case, you redact their name -- use a marker! -- and document that process as part of your data review. Either way, it's complete overkill. It's not about following the letter of the law; it's about the spirit of the law. No one is going to get sued or fined for providing a public guest book.

r3bl 8y ago

Absolutely not. At best, you can challenge them to remove the page with your contribution to the guest book.

Spearchucker 8y ago
TipEx would do, and you could preserve the page.
- 0xffff2 8y ago
  TipEx == White Out for other US residents. (I had to look it up.)

deleted 8y ago

[deleted]

PeterisP 8y ago

As far as I'm aware, GDPR doesn't make any new prohibitons in this regard - however, it's quite plausible that they were already technically forbidden for years by the earlier data privacy laws, but simply most organizations didn't pay much attention to them.

wbeckler 8y ago

Recital 15 of the GDPR states that it only applies "to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system." So if you don't file the sign in book, it's out of scope of the GDPR.