3 ms·
I think they’d have a hard time justifying the legitimate interest assessment to keep that data forever. I agree with your statement though, but the GDPR issue
by waffleiron 4y ago
I think they’d have a hard time justifying the legitimate interest assessment to keep that data forever.
I agree with your statement though, but the GDPR issue is the retention time, not a DSAR issue.
- ceejayoz 4y ago"I have a legitimate interest in never doing business with someone who defrauded me" seems like a reasonably easy argument to make.
- waffleiron 4y agoIt’s an easy argument, but that doesn’t make it correct. Within law “crimes” have a statue of limitations and almost never infinite long punishment. A strong argument is needed to override someones rights for an unlimited time like that. If you work in the EU, have a chat with your DPO/Privacy team cause I bet they would actually find this an interesting conversation too.
- ceejayoz 4y agoAs part of our privacy team, I'm glad it's someone else's argument to have in court someday.
- f1shy 4y agoThe problem is the company is in a privileged position. And there have to be limits. If not, they could stretch the definition of "defrauded me" to whatever they want, for example including discrimination of any kind.