5 ms·

GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't

GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't see your data in a machine-readable format or delete it.

the_mitsuhiko 8y ago
There are limits to which data can be requested to be deleted.
Cass 8y ago
It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done. Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?
- 0xffff2 8y ago
  1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.
  - jdietrich 8y ago
    >1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
- thephyber 8y ago
  > Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically? Sounds like a DDoS waiting to happen.
donogh 8y ago
It does not have to be machine readable. GDPR is technologically neutral. If the medium of storage is paper, a data subject access request can be fulfilled on paper. For example, photocopy the page, redact the other names, and mail the copy to the data subject. If the data subject access request is sent by email, you can take it a step further and scan and email that page. Still, it does not have to be machine readable.
- jamescostian 8y ago
  Can you point me to the text in the GDPR says what you are saying? IANAL and there's a good chance I'm just misreading the GDPR, but doesn't Article 20[0] completely disagree with you? In addition, imagine the person with the guest list lost the password to their email after putting you on their guest list, and now you don't have their new email address to ask them for the data [0] https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/
  - jInFluxx 8y ago
    1(b) of article 20 clarifies that it had to be machine readable where: the processing is carried out by automated means.
  - donogh 8y ago
    That's the right to data portability, which is your right to have your data with an electronic service transferred to another service in a machine readable format. It has nothing to do with data subject access requests, which is encoded in Article 15: https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ "Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form." That does not mean machine readable.
pwinnski 8y ago
If you run a hotel, you can presumably answer the phone, and a photocopier and a dark pen should be enough to comply with reporting and deletion requirements.

the_mitsuhiko 8y ago

There are limits to which data can be requested to be deleted.

Cass 8y ago

It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done. Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

0xffff2 8y ago
1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.
- jdietrich 8y ago
  >1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
thephyber 8y ago
> Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically? Sounds like a DDoS waiting to happen.

donogh 8y ago

It does not have to be machine readable. GDPR is technologically neutral. If the medium of storage is paper, a data subject access request can be fulfilled on paper. For example, photocopy the page, redact the other names, and mail the copy to the data subject. If the data subject access request is sent by email, you can take it a step further and scan and email that page. Still, it does not have to be machine readable.

jamescostian 8y ago
Can you point me to the text in the GDPR says what you are saying? IANAL and there's a good chance I'm just misreading the GDPR, but doesn't Article 20[0] completely disagree with you? In addition, imagine the person with the guest list lost the password to their email after putting you on their guest list, and now you don't have their new email address to ask them for the data [0] https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/
- jInFluxx 8y ago
  1(b) of article 20 clarifies that it had to be machine readable where: the processing is carried out by automated means.
- donogh 8y ago
  That's the right to data portability, which is your right to have your data with an electronic service transferred to another service in a machine readable format. It has nothing to do with data subject access requests, which is encoded in Article 15: https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ "Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form." That does not mean machine readable.

pwinnski 8y ago

If you run a hotel, you can presumably answer the phone, and a photocopier and a dark pen should be enough to comply with reporting and deletion requirements.