3 ms·
A bank would entirely be entitled to keep the info around. All information that must be retained by law (such as receipts, financial transactions etc.) is exemp
by Xylakant 5y ago
A bank would entirely be entitled to keep the info around. All information that must be retained by law (such as receipts, financial transactions etc.) is exempt from the GDPR and you cannot ask for deletion. You can ask that the holder of that information does not use it for purposes other than the ones covered by law, but that’s the full extend of it.
- spacebanana7 5y agoThe same principal about foreign key relationships could be applied to messaging apps, restaurant booking services or anything else where a user's relationships with other entities/users would allow them to be identified.
- Xylakant 5y agoThe posting I responded to was about a case where the transactions themselves cannot be deleted since they must be retained for accounting reasons, so the same reasoning applies here: If they need to retain the messages/bookings/... for legal/accounting reasons, then they're exempt. If they don't need to retain them, they can just delete them.
- spacebanana7 5y agoThe banking example was a bit muddled because it mixed the necessity of deletion with the method of deletion. Wherever possible a business should delete relational data upon request. However, relational data is special because it cannot be effectively deleted by overriding user data with random values as Confluence seems to do. Even if banks were allowed to delete customer data, they would face the same problem as social or booking services in that their relational data must be truly 'removed' rather than just overridden.