4 ms·

It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your phys

by Cass 8y ago

It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done. Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

0xffff2 8y ago
1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.
- jdietrich 8y ago
  >1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
thephyber 8y ago
> Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically? Sounds like a DDoS waiting to happen.

by Cass 8y ago

0xffff2 8y ago

1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.

jdietrich 8y ago
>1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/

thephyber 8y ago

> Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically? Sounds like a DDoS waiting to happen.