4 ms·

The focus of the spirit of GDPR is PII at its core. Communications with the user such as email exchanges, transaction records, etc are fine to preserve as long

The focus of the spirit of GDPR is PII at its core. Communications with the user such as email exchanges, transaction records, etc are fine to preserve as long as all PII have been scrubbed and are dissociated from the user.

M2Ys4U 6y ago
Not "PII", personal data. PII is a US legal term and means precisely nothing in the context of the GDPR.
- abraae 6y ago
  If you remove PII, then whatever you are left with is no longer personal data.
  - valesco 6y ago
    No, the GDPR's definition is broader and has been in use in EU privacy regulations for a decade prior. It's every piece of information that can be linked to an individual, even indirectly.
    - deleted 6y ago
      [deleted]
    - abraae 6y ago
      Exactly - when you remove all PII, you are left only with data that cannot be linked to the individual, even indirectly.
Fradow 6y ago
To be more precise, the focus of the spirit of GDPR is processing of personal data. When you receive a deletion request, you must delete the data and stop using it from anywhere you don't have a legitimate reason to continue processing it under one of the reasons for processing personal data without user consent. Which is easier said than done, because it's against general development practice of having a single copy of any data that you use everywhere without much checking. Instead, you have to either check a flag before using data (do I have consent? Has it been revoked?), or keep several copies of the same data for distinct use (for example, one copy for your app, one copy for legal reasons). The first approach helps you to be able to prove consent. The second approach helps you when you need to archive data past its retention date.
jayelbe 6y ago
This is completely meaningless. PII as a term from US legislation and has nothing to do with GDPR.
closeparen 6y ago
GDPR personal data is any record pertaining to an individual. That definitely includes transactions and communications.

M2Ys4U 6y ago

Not "PII", personal data. PII is a US legal term and means precisely nothing in the context of the GDPR.

abraae 6y ago
If you remove PII, then whatever you are left with is no longer personal data.
- valesco 6y ago
  No, the GDPR's definition is broader and has been in use in EU privacy regulations for a decade prior. It's every piece of information that can be linked to an individual, even indirectly.
  - deleted 6y ago
    [deleted]
  - abraae 6y ago
    Exactly - when you remove all PII, you are left only with data that cannot be linked to the individual, even indirectly.

Fradow 6y ago

To be more precise, the focus of the spirit of GDPR is processing of personal data. When you receive a deletion request, you must delete the data and stop using it from anywhere you don't have a legitimate reason to continue processing it under one of the reasons for processing personal data without user consent. Which is easier said than done, because it's against general development practice of having a single copy of any data that you use everywhere without much checking. Instead, you have to either check a flag before using data (do I have consent? Has it been revoked?), or keep several copies of the same data for distinct use (for example, one copy for your app, one copy for legal reasons). The first approach helps you to be able to prove consent. The second approach helps you when you need to archive data past its retention date.

jayelbe 6y ago

This is completely meaningless. PII as a term from US legislation and has nothing to do with GDPR.

closeparen 6y ago

GDPR personal data is any record pertaining to an individual. That definitely includes transactions and communications.