4 ms·

This isn't some sort of nefarious "processing": re the GDPR, storage is a form of processing. So is deletion. And, as the processor, they are required to do a

This isn't some sort of nefarious "processing": re the GDPR, storage is a form of processing. So is deletion. And, as the processor, they are required to do as the controller (you) instructs.

vincnetas 4y ago
Can i instruct to "do not collect"? Or could they for example "do not collect" until i ask them to?
- marcosdumay 4y ago
  It's a SaaS product. "Collecting" is how it does anything.
dijit 4y ago
> re the GDPR, storage is a form of processing. That's not true, which lawyer told you this? I'm honestly really tired of the FUD surrounding GDPR, it's not actually that complicated.
- guhidalg 4y ago
  https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-constitutes-data-processing_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Check YOUR FUD at the door please.
  - dijit 4y ago
    Storage with intent to process. Not storage itself. IE if you send me a file and I put it on a drive and don’t give it to anyone or read it on behalf of anyone but you: it’s fine.
    - dkyc 4y ago
      It literally isn't. The source provided by the parent confirms it. There is no 'with intent to process' clause. > Processing covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, _storage_, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
      - dijit 4y ago
        > It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data. I feel like you're intentionally missing the second section here. Regardless, GDPR has hundreds of provisions where it excludes data as long as it's not processed, "storing is processing" in so far as it's secure and not being used by anyone except the account holder isn't going to stand up in any court on the planet, even luddite ones.
        LegionMammal978 4y ago
        You might be parsing the sentence incorrectly. I'd generally read it as: > It includes {the [(collection), (recording), (organisation), (structuring), (storage), (adaptation or alteration), (retrieval), (consultation), (use), (disclosure by {[transmission], [dissemination] or [otherwise making available]}), (alignment or combination), (restriction), (erasure) or (destruction)] of personal data}. So there is no "second section" of the sentence, just a long list. The text of the GDPR has the exact same list [0]. [0] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
PeterisP 4y ago
>And, as the processor, they are required to do as the controller (you) instructs. There seems to be a terminology issue here, "You" would generally be the data subject, not the data controller, unless you are a company. If you're directly using Office 365 or Google workspace, then MSFT/Google would be the data controller (the primary company who handles the private data), and any subcontractors involved would be data processors on behalf of the controller. If you're a user in the school system, and have no direct agreement with MSFT/Google, then the school may be the data controller and MSFT/Google handling that data on behalf of the school.

This isn't some sort of nefarious "processing": re the GDPR, storage is a form of processing. So is deletion. And, as the processor, they are required to do as the controller (you) instructs.

vincnetas 4y ago

Can i instruct to "do not collect"? Or could they for example "do not collect" until i ask them to?

marcosdumay 4y ago
It's a SaaS product. "Collecting" is how it does anything.

dijit 4y ago

> re the GDPR, storage is a form of processing. That's not true, which lawyer told you this? I'm honestly really tired of the FUD surrounding GDPR, it's not actually that complicated.

guhidalg 4y ago
https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-constitutes-data-processing_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Check YOUR FUD at the door please.
- dijit 4y ago
  Storage with intent to process. Not storage itself. IE if you send me a file and I put it on a drive and don’t give it to anyone or read it on behalf of anyone but you: it’s fine.
  - dkyc 4y ago
    It literally isn't. The source provided by the parent confirms it. There is no 'with intent to process' clause. > Processing covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, _storage_, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
    - dijit 4y ago
      > It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data. I feel like you're intentionally missing the second section here. Regardless, GDPR has hundreds of provisions where it excludes data as long as it's not processed, "storing is processing" in so far as it's secure and not being used by anyone except the account holder isn't going to stand up in any court on the planet, even luddite ones.
      - LegionMammal978 4y ago
        You might be parsing the sentence incorrectly. I'd generally read it as: > It includes {the [(collection), (recording), (organisation), (structuring), (storage), (adaptation or alteration), (retrieval), (consultation), (use), (disclosure by {[transmission], [dissemination] or [otherwise making available]}), (alignment or combination), (restriction), (erasure) or (destruction)] of personal data}. So there is no "second section" of the sentence, just a long list. The text of the GDPR has the exact same list [0]. [0] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/

PeterisP 4y ago

>And, as the processor, they are required to do as the controller (you) instructs. There seems to be a terminology issue here, "You" would generally be the data subject, not the data controller, unless you are a company. If you're directly using Office 365 or Google workspace, then MSFT/Google would be the data controller (the primary company who handles the private data), and any subcontractors involved would be data processors on behalf of the controller. If you're a user in the school system, and have no direct agreement with MSFT/Google, then the school may be the data controller and MSFT/Google handling that data on behalf of the school.