3 ms·

Par for the course these days. And its getting worse. When you have 40 million users and a few hundred people running the system, all kinds of issues just sit

• Silhouette 6y ago
  For those in the EU/UK, it's worth noting that the GDPR isn't just about controlling how personal data is used. It also imposes obligations on data processors to take care of that data properly. The usual issues arise about enforceability as long as this is only European law, and about ambiguity in the way the GDPR itself is written. However, it seems likely that arbitrary deletion of personal data like this could fall foul of the requirements for integrity and availability, particularly given the GP was a paying customer.
  • TheNorthman 6y ago
    Because we're talking about an automated decision, Art. 22(1, 3) of the GDPR applies as well where: > The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. And any exceptions still require the data controller to provide: > suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.