4 ms·
But GDPR says I can delete my data, I’m confused
by sbhn 8y ago
But GDPR says I can delete my data, I’m confused
- seangrant 8y agoNot in America
- notamerican 8y agoWell, not if you're physically located in in the U.S. at the tome, but the GDPR effects non-EU businesses and governments as long as the person involved is an EU citizen.
- vageli 8y ago> Well, not if you're physically located in in the U.S. at the tome, but the GDPR effects non-EU businesses and governments as long as the person involved is an EU citizen. In what court would you bring a case against the United States under the GDPR?
- cyphar 8y agoIf the business operates with the EU, this generally involves having a subsidiary in an EU country (most companies have subsidiaries in Ireland that own all of their "IP" for tax avoidance reasons, and thus can be very trivially fined as they operate as an EU company). I get your point, but practically most large companies have EU subsidiaries (and in many cases, structure their businesses to exploit the benefits of EU nations like Ireland) and thus must follow EU laws anyway.
- vageli 8y agoI was addressing the "governments" part in > but the GDPR effects non-EU businesses and governments specifically.
- briandear 8y agoNo it doesn’t! The citizenship has nothing to do with the law. It’s the residency. An EU citizen living in New York has exactly zero to do with GDPR. An American citizen living in Paris though, would be covered by the law.
- cyphar 8y agoHowever it does apply to EU companies regardless of where the data subject is, and given that Apple is clearly an EU company if you see how its business is structured to (illegally) avoid taxes[1], it would apply in both cases. But, more importantly, the GDPR doesn't help if the data is needed for a criminal investigation. There are very clear exemptions to the GDPR protections, and this is one of them. [1]: https://en.wikipedia.org/wiki/EU_illegal_State_aid_case_against_Apple_in_Ireland https://en.wikipedia.org/wiki/EU_illegal_State_aid_case_agai...
- geofft 8y agoI believe the GDPR allows a company to refuse (or delay) processing your request to delete their data about you if they have a legitimate reason, and being legally obligated to hold onto that data is one of the legitimate reasons. However, GDPR is a big law and I am not a European lawyer (I am neither, in fact), so I'm curious if my understanding is wrong. What section of GDPR are you thinking of and what exceptions does it have?
- zaarn 8y agoThe GDPR regulation has some exceptions for legal requests and generally puts itself below local laws and regulations that specify further, to my knowledge, if you get a letter from the police/state that says some data is needed for a court case, you can safely ignore all deletion requests for that data until such time that the state/police request is no longer valid (ie, they copied it off your server). However, once they have the data (and after asking the forensics team if it's okay) you can certainly follow up on the request and it's probably good manners to inform people that there is a legal obligation holding up the deletion of some data (unless the warrant prohibits that).
- DATACOMMANDER 8y agoThis again raises the issue of speech vs absence of speech. What if a cloud provider has applications that confirm deletions that are initiated by the user? A secret warrant prohibits disclosure of the warrant’s existence, but now we’re talking about a requirement to actively lie to users. I really don’t think that this hair-splitting.
- zaarn 8y agoThen you'll have to lie to the user. Simple as that.