6 ms·

The weird thing about this case is that it was completely informal data collection, about employees by their mid-level managers. Doesn't even look like upper ma

by brazzy 6y ago

The weird thing about this case is that it was completely informal data collection, about employees by their mid-level managers. Doesn't even look like upper management was involved. Very different from the usual concerns about large-scale, organized collection of data about end users.

jacquesm 6y ago
I think that's actually excellent. It shows that any kind of data collection is subject to the GDPR. This is something I've been warning companies about for a while now, they believe - quite erroneously - that as long as the system isn't automated that they are free and clear but the GDPR doesn't say anything about automation. So even if it is informal and even if you use stone tablets you are still subject to the law.
- ckastner 6y ago
  Well, strictly speaking, automation is a key factor. If it's automated, it's always GDPR. If it's not automated, it's GDPR under the condition that the data is part of a filing system. So if you order your stone tablets alphabetically by their title, it's GDPR, but jumble a sufficiently large pile of stone tablets and you're in the clear. In practice, this means that if you have a warehouse full of unordered boxes full of unordered forms, then somebody exercising their right to be forgotten cannot force you to go through every single box to see if there is data in there. Conversely and frustratingly, if you have one gigantic folder of digital media, then you are technically required to actually go through that data, although I've heard of cases argued with authorities where this can be forgone in cases where it would be extremely uneconomical. I'm still anxiously waiting for the first big decision on e-mail, for example. In large-scale corporate environments, good luck identifying every email containing personal data of a particular person, should that person ever exercise their right to be forgotten. (Edit: no idea why you got downvoted, you raise an important point)
  - jacquesm 6y ago
    That organizational aspect is actually not all that clear cut and I would hold off on making strong statements about what counts as a filing system. A stack of paper might qualify, ordered or not for instance when it pertains to similar data gathered on others, something that can be searched automatically would definitely qualify and so on. Finding out where that line is is probably going to be an interesting academic exercise which will result in lots of fines that could have been avoided easily: if you don't have a right to process certain data in an automated way pretend you don't have that right at all to stay safe. After all, once the data is sufficiently disorganized to be searched efficiently it is also sufficiently disorganized to keep it secure and a data leak of disorganized data would be just as big an issue as gathering the data itself.
    - ckastner 6y ago
      I agree; what counts as a filing system remains to be seen. Hence why I used a "sufficiently large" pile of stone tablets, to put it beyond doubt that it's not organized regardless of how strict or relaxed the interpretation. I don't recall the source at the moment, but one convincing argument I've heard was that an amount of disorganized data that you can organize given a few hours time would probably be treated as equivalent to organized data in the eyes of the authorities, otherwise you'd have a trivial loophole.
      - jacquesm 6y ago
        There is that and there are multiple cases where a single individual affected by a transgression already led to fines as well as the fairly low count that is used to determine if a transgression is a significant one (10!).
  - tempsolution 6y ago
    If that was true, it would be hilarious. The law does only apply if the defendant keeps his records in order :D. Normally, you get fined extra. Like you get fined for not keeping order, then for being late at producing said document (first you need to find it in your mess after all) and then fined for the document being what it is.
ckastner 6y ago
> The weird thing about this case is that it was completely informal data collection, about employees by their mid-level managers. The article says that "H&M collected information on illnesses [...]". Data concerning health is among the Article 9 special categories of personal data [1], the processing of which is generally prohibited, with only a few exceptions. I'm all but certain that a mid-level manager collecting this data does not fall under any of the exceptions. [1] https://gdpr.eu/article-9-processing-special-categories-of-personal-data-prohibited/ https://gdpr.eu/article-9-processing-special-categories-of-p...
- jacquesm 6y ago
  It's pretty much an as open-and-shut of a clear violation of having consent and a right to process that data as you could come up with. They got off light in my view but then again, it is a first time offense so maybe not all that light.
- mongol 6y ago
  You are most certainly right. But I think parent's point was that informal data gathering on mid manager level is a difficult thing to protect yourself from, as a large corporation. Any clueless manager can open an Excel file and type in personal information about their reports. Training and policies can help, but not completely prevent. When you build larger software systems you can have audit processes in place etc. But the informal level is tricky..
  - germanier 6y ago
    In this case they seem to have collected 60 GB data shared among 50 managers. It's interesting that no one raised an issue. It only became known after the network share was made visible to more people by mistake.
    - 542354234235 6y ago
      That clearly rises well above the level of “someone entered personal data into a spreadsheet”. At that level it is absolutely a negligent failure of the company to A. train and educate its managers, and B. audit operations to shut down activities like this.
mlang23 6y ago
There is nothing weird about this. If you are not allowed to collect/archive certain data, you are not allowed to do so. This is not limited to customers. And that is good.

by brazzy 6y ago

jacquesm 6y ago

I think that's actually excellent. It shows that any kind of data collection is subject to the GDPR. This is something I've been warning companies about for a while now, they believe - quite erroneously - that as long as the system isn't automated that they are free and clear but the GDPR doesn't say anything about automation. So even if it is informal and even if you use stone tablets you are still subject to the law.

ckastner 6y ago
Well, strictly speaking, automation is a key factor. If it's automated, it's always GDPR. If it's not automated, it's GDPR under the condition that the data is part of a filing system. So if you order your stone tablets alphabetically by their title, it's GDPR, but jumble a sufficiently large pile of stone tablets and you're in the clear. In practice, this means that if you have a warehouse full of unordered boxes full of unordered forms, then somebody exercising their right to be forgotten cannot force you to go through every single box to see if there is data in there. Conversely and frustratingly, if you have one gigantic folder of digital media, then you are technically required to actually go through that data, although I've heard of cases argued with authorities where this can be forgone in cases where it would be extremely uneconomical. I'm still anxiously waiting for the first big decision on e-mail, for example. In large-scale corporate environments, good luck identifying every email containing personal data of a particular person, should that person ever exercise their right to be forgotten. (Edit: no idea why you got downvoted, you raise an important point)
- jacquesm 6y ago
  That organizational aspect is actually not all that clear cut and I would hold off on making strong statements about what counts as a filing system. A stack of paper might qualify, ordered or not for instance when it pertains to similar data gathered on others, something that can be searched automatically would definitely qualify and so on. Finding out where that line is is probably going to be an interesting academic exercise which will result in lots of fines that could have been avoided easily: if you don't have a right to process certain data in an automated way pretend you don't have that right at all to stay safe. After all, once the data is sufficiently disorganized to be searched efficiently it is also sufficiently disorganized to keep it secure and a data leak of disorganized data would be just as big an issue as gathering the data itself.
  - ckastner 6y ago
    I agree; what counts as a filing system remains to be seen. Hence why I used a "sufficiently large" pile of stone tablets, to put it beyond doubt that it's not organized regardless of how strict or relaxed the interpretation. I don't recall the source at the moment, but one convincing argument I've heard was that an amount of disorganized data that you can organize given a few hours time would probably be treated as equivalent to organized data in the eyes of the authorities, otherwise you'd have a trivial loophole.
    - jacquesm 6y ago
      There is that and there are multiple cases where a single individual affected by a transgression already led to fines as well as the fairly low count that is used to determine if a transgression is a significant one (10!).
- tempsolution 6y ago
  If that was true, it would be hilarious. The law does only apply if the defendant keeps his records in order :D. Normally, you get fined extra. Like you get fined for not keeping order, then for being late at producing said document (first you need to find it in your mess after all) and then fined for the document being what it is.

ckastner 6y ago

> The weird thing about this case is that it was completely informal data collection, about employees by their mid-level managers. The article says that "H&M collected information on illnesses [...]". Data concerning health is among the Article 9 special categories of personal data [1], the processing of which is generally prohibited, with only a few exceptions. I'm all but certain that a mid-level manager collecting this data does not fall under any of the exceptions. [1] https://gdpr.eu/article-9-processing-special-categories-of-personal-data-prohibited/ https://gdpr.eu/article-9-processing-special-categories-of-p...

jacquesm 6y ago
It's pretty much an as open-and-shut of a clear violation of having consent and a right to process that data as you could come up with. They got off light in my view but then again, it is a first time offense so maybe not all that light.
mongol 6y ago
You are most certainly right. But I think parent's point was that informal data gathering on mid manager level is a difficult thing to protect yourself from, as a large corporation. Any clueless manager can open an Excel file and type in personal information about their reports. Training and policies can help, but not completely prevent. When you build larger software systems you can have audit processes in place etc. But the informal level is tricky..
- germanier 6y ago
  In this case they seem to have collected 60 GB data shared among 50 managers. It's interesting that no one raised an issue. It only became known after the network share was made visible to more people by mistake.
  - 542354234235 6y ago
    That clearly rises well above the level of “someone entered personal data into a spreadsheet”. At that level it is absolutely a negligent failure of the company to A. train and educate its managers, and B. audit operations to shut down activities like this.

mlang23 6y ago

There is nothing weird about this. If you are not allowed to collect/archive certain data, you are not allowed to do so. This is not limited to customers. And that is good.