3 ms·
At least the GPDR should allow you to correct the age. I don't think it has any provisions that say that if you entered incorrect data yourself, you waive your
by fweimer 4y ago
At least the GPDR should allow you to correct the age. I don't think it has any provisions that say that if you entered incorrect data yourself, you waive your right to have data corrected.
- ceejayoz 4y agoThey'd be required to correct the age, but they wouldn't be required to delete the "this person defrauded us by giving a false age" flag/note on your internal profile.
- waffleiron 4y agoI think they’d have a hard time justifying the legitimate interest assessment to keep that data forever. I agree with your statement though, but the GDPR issue is the retention time, not a DSAR issue.
- ceejayoz 4y ago"I have a legitimate interest in never doing business with someone who defrauded me" seems like a reasonably easy argument to make.
- waffleiron 4y agoIt’s an easy argument, but that doesn’t make it correct. Within law “crimes” have a statue of limitations and almost never infinite long punishment. A strong argument is needed to override someones rights for an unlimited time like that. If you work in the EU, have a chat with your DPO/Privacy team cause I bet they would actually find this an interesting conversation too.
- ceejayoz 4y agoAs part of our privacy team, I'm glad it's someone else's argument to have in court someday.
- f1shy 4y agoThe problem is the company is in a privileged position. And there have to be limits. If not, they could stretch the definition of "defrauded me" to whatever they want, for example including discrimination of any kind.