I totally agree, re: possibly being unsolvable for some companies. It'll be very interesting to see how the actual enforcement develops. I suspect the regulato

I totally agree, re: possibly being unsolvable for some companies. It'll be very interesting to see how the actual enforcement develops. I suspect the regulators want companies to create these kinds of consistent identifiers where they don't already exist and make sure that they ride along with personal data wherever it finds it's way. There's a comment in the article about an oblique reference in an email to "a tall, bald guy living on East Whatever St." being PII and must be included in data subject review/deletion requests. How do you find that, even if you're scanning everywhere? What about users' computers with excel sheets with personal data? That's how reporting is done a lot of places that I know of. You can make them install an agent to scan data or require all data be put in centralized storage like a network share or corporate subscription to a service like dropbox or something. But, I 100% guarantee that Andy from HR or Jane from marketing going to "forget" to do that or put it in some insane format that the scanner can't handle.