3 ms·

I wonder how this is supposed to work with workplace apps such as Slack. Assume I am leaving my job and want my personal information removed from this third-pa

by osener 4y ago

I wonder how this is supposed to work with workplace apps such as Slack. Assume I am leaving my job and want my personal information removed from this third-party service (Slack). They say [1] "Primary Owners of a workspace or org must contact Slack to request deletion of a deactivated member's profile information.". What if I contact the "Primary Owner" before leaving my job and they ignore my request, or if I've already left and don't know how to contact them or who they are? Why can't I simply request that my personal information be removed from a completely third-party American company's database? I thought about this out loud before, and got the response "If you are using company account, company owns the data. The data produced during company time is company's property. Company has to request for deletion. Slack is right about it." That made makes me ask more questions: - Is my full name, birth date, telephone number, job and other details Slack collects company property? - Can they also sell this to other third parties, along with my social security number, which the company also collected during business hours? - Is Slack also free to sell this data to third parties? - Does GDPR protect your personal information ONLY if you gave it away during your free / unemployed time using your personally owned devices and ONLY to services you have admin access to? [1] https://slack.com/help/articles/360000360443-Delete-profile-information-from-Slack https://slack.com/help/articles/360000360443-Delete-profile-...

Stranger43 4y ago
You could ask the local DPA to look at your former employer(and then sue them if they decide to ignore you). Companies have been fined for lax handling of employee data. Slack is likely trying to operate under one of the attempts to replace the invalidated "privacy shield" framework(the current attempt is summarized here https://www.tadpf.eu/ https://www.tadpf.eu/) for their European enterprise customers, and a part of this is having contracts prohibiting slack from handing out the data to any 3rd party, but your relationship here is with your former employer and not slack. the Schrems rulings is a bit of a problem for slack here but that's not because slack is necessarily violating the GDPR directly but because the US does not live up to EU's standards for what a modern democracy is allowed to subject people to to in terms of protection against "unreasonable search and seizure"(this term actually comes form the Fourth Amendment of the us constitution but somehow the US courts don't think it applies to foreign persons or digital records held by cloud companies).

by osener 4y ago

Stranger43 4y ago

You could ask the local DPA to look at your former employer(and then sue them if they decide to ignore you). Companies have been fined for lax handling of employee data. Slack is likely trying to operate under one of the attempts to replace the invalidated "privacy shield" framework(the current attempt is summarized here https://www.tadpf.eu/ https://www.tadpf.eu/) for their European enterprise customers, and a part of this is having contracts prohibiting slack from handing out the data to any 3rd party, but your relationship here is with your former employer and not slack. the Schrems rulings is a bit of a problem for slack here but that's not because slack is necessarily violating the GDPR directly but because the US does not live up to EU's standards for what a modern democracy is allowed to subject people to to in terms of protection against "unreasonable search and seizure"(this term actually comes form the Fourth Amendment of the us constitution but somehow the US courts don't think it applies to foreign persons or digital records held by cloud companies).