4 ms·

Processing is defined in Article 4(2): > 2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal da

by bulatb 8y ago

Processing is defined in Article 4(2): > 2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ - BUT - Article 2(1) limits the whole GDPR to personal data "processed" in the context of a filing system, whether electronic or physical. In other words (in my non-lawyer reading): If I have your business card in my pocket, or I leave it on the table, or throw it away, I'm not "processing" your data in a covered way—even though I have it. If I put it in my stack of business cards or add you to my CRM, I am. https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/

JumpCrisscross 8y ago
> retrieval, consultation, use These three words can mean everything and nothing. It will take years to see how each of the EU's twenty-eight members' regulators take to interpreting them.
- bulatb 8y ago
  I read this part as being broad, but not vague. Processing personal data means doing anything with it in any way, including simply having it. If the data takes part in a process you have, you're processing that data.
  - lucideer 8y ago
    Exactly. The term could have been "storing", but that would have been potentially too narrow, as it could be argued that proxies are excluded. As such, "processing" is like a more complete term for "storing or handling".
donatj 8y ago
> organisation, structuring So having a database index would almost certainly be covered.
- tremon 8y ago
  Having a database would already be covered by storage, I'm not sure what having database indexes would add to that.
  - donatj 8y ago
    Having an index though is additional processing. If you could simply note 'in a database' and not have to note processing the database is doing, you could do all your processing with stored procedure.
    - bulatb 8y ago
      I would think of it this way: 1. Are you processing their email address? 2. For what purposes? Why do you need it at all? (You might do many different instances or types of processing for one purpose.) 3. What's your lawful basis for processing their email address for each purpose? So "in the database" would not be what they're looking for. But if it's in the database because you need to a) log them in, and b) send transactional/account-related emails, then that's what you say. I wouldn't bother them with how specifically or technically you make that happen, unless it involves third parties or something like that, because that isn't really what they asked for. So: 1. Yes, I have it. 2. To identify you to the service, let you sign in, and send account-related messages like password reset codes. 3. Performance of a contract under Article 6(1)(b), providing the service they signed up for. But again, I'm not a lawyer. Article 15, on access requests: https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ How to interpret Article 15: https://gdpr-info.eu/recitals/no-63/ https://gdpr-info.eu/recitals/no-63/

by bulatb 8y ago

JumpCrisscross 8y ago

> retrieval, consultation, use These three words can mean everything and nothing. It will take years to see how each of the EU's twenty-eight members' regulators take to interpreting them.

bulatb 8y ago
I read this part as being broad, but not vague. Processing personal data means doing anything with it in any way, including simply having it. If the data takes part in a process you have, you're processing that data.
- lucideer 8y ago
  Exactly. The term could have been "storing", but that would have been potentially too narrow, as it could be argued that proxies are excluded. As such, "processing" is like a more complete term for "storing or handling".

donatj 8y ago

> organisation, structuring So having a database index would almost certainly be covered.

tremon 8y ago
Having a database would already be covered by storage, I'm not sure what having database indexes would add to that.
- donatj 8y ago
  Having an index though is additional processing. If you could simply note 'in a database' and not have to note processing the database is doing, you could do all your processing with stored procedure.
  - bulatb 8y ago
    I would think of it this way: 1. Are you processing their email address? 2. For what purposes? Why do you need it at all? (You might do many different instances or types of processing for one purpose.) 3. What's your lawful basis for processing their email address for each purpose? So "in the database" would not be what they're looking for. But if it's in the database because you need to a) log them in, and b) send transactional/account-related emails, then that's what you say. I wouldn't bother them with how specifically or technically you make that happen, unless it involves third parties or something like that, because that isn't really what they asked for. So: 1. Yes, I have it. 2. To identify you to the service, let you sign in, and send account-related messages like password reset codes. 3. Performance of a contract under Article 6(1)(b), providing the service they signed up for. But again, I'm not a lawyer. Article 15, on access requests: https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ How to interpret Article 15: https://gdpr-info.eu/recitals/no-63/ https://gdpr-info.eu/recitals/no-63/