4 ms·

>If you ask for your data to be deleted does that include your address in my contacts? I'm assuming that "my" in this sentence means a business, since individu

>If you ask for your data to be deleted does that include your address in my contacts? I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR, and that the thrust of your question revolves around, say, a customer support portal. Yes, addresses have to go unless you have a legitimate business reason to keep them. For tax purposes or to prove something in an active court case are both examples of a reason you could keep the address at least temporarily. >Does it include your messages to me? No, they could be anonymised instead. If the messages contain PII you might need to sanitize them. >Does it include your posts that appeared on my feed? Same as the previous question. >It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. This is defined on, like, the second page of the GDPR document. Article 2 "material scope" point 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. GDPR kicks in when you start processing this stuff automatically. If you want to handle your entire businesses paperwork via a set of paper ledgers with humans in front of them, that'll make you GDPR immune. Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. If someone told you GDPR was complex, they lied to you. The legislation is dead simple and most of the document is actually not about what businesses need to do but about what the EU bureaucrats need to do. You only need to read about half of it, the rest is irrelevant to you. If this matters to you, just go read the damn thing. Trust me, it's a fricking revelation to do so, you'll be staggered by the amount of bullshit people spout about it and the amount of needless fretting and hand-wringing they do once you know how simple it is. Don't get me wrong, the implementation may be hard for some businesses, but I'll also tell you straight up, there are lots of businesses voluntarily making their GDPR implementations harder and more expensive than necessary because they didn't bother actually reading the law and are instead going off third-hand chinese-whisper information, which is a crazy way to run a business.

XCabbage 8y ago
> I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Does Google, as the data controller who ultimately stores tokyodude's contact list for him, then have to purge your email address from tokyodude's address book? > Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. This condescension is obnoxious and unwarranted. Just take a look at the complexity of the conditions at https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ dictating when the right to erasure applies. Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. So can they just argue they have a "legitimate interest", under article 6(1) point (a), in preserving tokyodude's address book? I have no idea. Meanwhile, point (f), linking to article 8 about children, is saying - I think - that a data controller must honour an erasure request if it's about data they collected from a child, even if they have another legal ground for processing that data. So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? How about your actual emails to him? Can you demand that Google deletes them from his inbox? As far as I can see, the answer logically ought to be "yes"; Art 17 (1) (f) applies and I don't see any exception that would let Google wriggle out of the obligation. But I'm not sure if any of the above, because this stuff is vague and complicated. If you truly think it's simple, I invite you to walk us through the answers to the scenarios I've explored above, supporting your assertions with relevant references to the text of the law. I do not expect you to be able to do so.
- Sir_Substance 8y ago
  >No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Oh, well in that case this is explicitly handled in recital 18. https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/ > Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. Yes. >So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? Yes. >How about your actual emails to him? Can you demand that Google deletes them from his inbox? Covered in recital 18. I totally agree with all your interpretations, well done. See what I mean about it not being that complex? Not that you shouldn't run all this past your company lawyer to make sure they agree mind you. After all, companies keep lawyers around for input on exactly these kinds of issues, might as well get your moneys worth. It's ok for you as a software developer to be unsure about some of these things, you're not a trained lawyer. What I'm being condescending about is software developers wailing "oh it's impossibly byzantine, oh it's impenetrable, oh woe, oh drat, oh heavy is the burden of being me in a GDPR-compliant era". Software developers regularly read documentation more complex than the GDPR legislation. Jesus, you'd think it was written in latin the way some people on hacker news cry about it.

XCabbage 8y ago

> I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Does Google, as the data controller who ultimately stores tokyodude's contact list for him, then have to purge your email address from tokyodude's address book? > Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. This condescension is obnoxious and unwarranted. Just take a look at the complexity of the conditions at https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ dictating when the right to erasure applies. Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. So can they just argue they have a "legitimate interest", under article 6(1) point (a), in preserving tokyodude's address book? I have no idea. Meanwhile, point (f), linking to article 8 about children, is saying - I think - that a data controller must honour an erasure request if it's about data they collected from a child, even if they have another legal ground for processing that data. So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? How about your actual emails to him? Can you demand that Google deletes them from his inbox? As far as I can see, the answer logically ought to be "yes"; Art 17 (1) (f) applies and I don't see any exception that would let Google wriggle out of the obligation. But I'm not sure if any of the above, because this stuff is vague and complicated. If you truly think it's simple, I invite you to walk us through the answers to the scenarios I've explored above, supporting your assertions with relevant references to the text of the law. I do not expect you to be able to do so.

Sir_Substance 8y ago
>No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Oh, well in that case this is explicitly handled in recital 18. https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/ > Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. Yes. >So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? Yes. >How about your actual emails to him? Can you demand that Google deletes them from his inbox? Covered in recital 18. I totally agree with all your interpretations, well done. See what I mean about it not being that complex? Not that you shouldn't run all this past your company lawyer to make sure they agree mind you. After all, companies keep lawyers around for input on exactly these kinds of issues, might as well get your moneys worth. It's ok for you as a software developer to be unsure about some of these things, you're not a trained lawyer. What I'm being condescending about is software developers wailing "oh it's impossibly byzantine, oh it's impenetrable, oh woe, oh drat, oh heavy is the burden of being me in a GDPR-compliant era". Software developers regularly read documentation more complex than the GDPR legislation. Jesus, you'd think it was written in latin the way some people on hacker news cry about it.