2 ms·

Great, so now we get to spend money on lawyers and time in the courts to decide what information falls under “OK to keep for a good reason”

Silhouette 8y ago
I couldn't agree more. The rules about erasure are full of holes like this. So are the rules about legitimate interests. And those represent, respectively, probably the most significant new subject right and probably the most common lawful basis for processing that isn't strictly necessary for some sort of legal compliance.
gsich 8y ago
A simple example: another law requires it.
- ww520 8y ago
  Your bank's requirement to verify a chargeback is not a law. It's a business contract.
  - gsich 8y ago
    And therefore saving the data is allowed.
    - Silhouette 8y ago
      Not necessarily. The performance of contract basis under the GDPR is for contracts with the data subject. You can't just agree a contract with some arbitrary third party and use that to circumvent any subject rights you don't like. For data processing purposes like this, you will normally have to rely on the legitimate interests basis. That's the one with the almost entirely non-specific definition, combined with the almost entirely non-specific balancing requirements. With a case like defending an unjustified chargeback, we might assume that the interest is surely both legitimate and overriding, but even that is only a personal view and not something any regulator has explicitly addressed in guidance, as far as I'm aware. In any case, plenty of other scenarios won't be so black and white.
wlll 8y ago
No, if you say you need the information for tax purposes (say) then the user will complain to the data protection authorities. These authorities will then accept or reject the complaint, and if accepted will help you to come into compliance.
- Silhouette 8y ago
  The trouble is, that's an assumption on your part, and it might not be a valid one. We have no idea yet how 28 different regulatory authorities will handle this sort of situation, or how much of an effort they will expect controllers and processors to make on their own if they are to receive the benefit of the doubt. And even if everything you assume proves to be correct, any formal interaction with authorities is stressful and expensive for a small business with limited time and resources available, and being confident that you aren't doing anything wrong in the first place is obviously preferable.

Silhouette 8y ago

I couldn't agree more. The rules about erasure are full of holes like this. So are the rules about legitimate interests. And those represent, respectively, probably the most significant new subject right and probably the most common lawful basis for processing that isn't strictly necessary for some sort of legal compliance.

gsich 8y ago

A simple example: another law requires it.

ww520 8y ago
Your bank's requirement to verify a chargeback is not a law. It's a business contract.
- gsich 8y ago
  And therefore saving the data is allowed.
  - Silhouette 8y ago
    Not necessarily. The performance of contract basis under the GDPR is for contracts with the data subject. You can't just agree a contract with some arbitrary third party and use that to circumvent any subject rights you don't like. For data processing purposes like this, you will normally have to rely on the legitimate interests basis. That's the one with the almost entirely non-specific definition, combined with the almost entirely non-specific balancing requirements. With a case like defending an unjustified chargeback, we might assume that the interest is surely both legitimate and overriding, but even that is only a personal view and not something any regulator has explicitly addressed in guidance, as far as I'm aware. In any case, plenty of other scenarios won't be so black and white.

wlll 8y ago

No, if you say you need the information for tax purposes (say) then the user will complain to the data protection authorities. These authorities will then accept or reject the complaint, and if accepted will help you to come into compliance.

Silhouette 8y ago
The trouble is, that's an assumption on your part, and it might not be a valid one. We have no idea yet how 28 different regulatory authorities will handle this sort of situation, or how much of an effort they will expect controllers and processors to make on their own if they are to receive the benefit of the doubt. And even if everything you assume proves to be correct, any formal interaction with authorities is stressful and expensive for a small business with limited time and resources available, and being confident that you aren't doing anything wrong in the first place is obviously preferable.