3 ms·
Note that "anonymization" has been legally found (DSB-D123.270/0009) to be acceptable to meet GDPR "erasure" requirements. However, this requires irrevocable ov
by petercooper 7y ago
Note that "anonymization" has been legally found (DSB-D123.270/0009) to be acceptable to meet GDPR "erasure" requirements. However, this requires irrevocable overwriting of PII rather than just slapping 1000 on the end ;-) If they'd changed the username and email address to some random string, however, they would most likely be compliant.
- isoskeles 7y agoWouldn't they also need to replace saved billing details, like address and full name, to anonymized garbage?
- mschuster91 7y agoIn Germany not; these are required by law (§147 AO, https://www.gesetze-im-internet.de/ao_1977/__147.html https://www.gesetze-im-internet.de/ao_1977/__147.html) to be kept for ten years. The legal base for allowing this national rule in European law is Art. 6, 1c GDPR.
- MaxBarraclough 7y agoI think something similar happens in the UK. It's generally believed here that laws telling you to retain data take precedence over the GDPR telling you to delete it. (I am very much not a lawyer, as you can doubtless tell.)
- matthewheath 7y agoYes. For example, HMRC requires that you keep various business records for 6 years (or longer, circumstance-specific) after the end of the company's financial year. Generally, the rule is "Delete the data unless there's a law that requires you not to" — and the UK's implementation of the GDPR (the Data Protection Act 2018) makes various explicit exemptions for this.
- jkaplowitz 7y agoBut they'd need to get rid of it in the 11th year, right? And even before then, they'd need to delete some of the earliest records for someone who has subscribed for more than 10 years. Lots of compliance traps remain.