gdpr: classification of a psychiatric report I'm following a job-related course regarding data protection and the GDPR (European Union, I'm located in Italy). My background is not in law. I was puzzled whether a psychiatric report (&quot;perizia psichiatrica&quot;, a document with legal purposes) falls in the sensitive data category. The course says it does not [edit: I double-checked, and the question was intentionally unclear, so probably that was the reason of the confusion], but I also read that &quot;Health data&quot; is indeed sensitive (https://www.gdpreu.org/the-regulation/key-concepts/special-categories-personal-data/). What is the reason behind this apparent paradox?
Its special personal information The GDPR uses “special” not “sensitive”. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
First of all, although the GDPR is stated to apply to any site which processes the data of any person who is in the EU, it is not clear how a site not located in the EU, does not business in the EU, and does not primarily target EU residents as its audience can be required to comply with the GDPR. To the best of my knowledge, no such case has yet been brought, much less decided. There has also been some debate on whether an IP address constitutes Personal Data under the GDPR, and if it always does so, or only under particular conditions. The European Court of Justice (ECJ) held that (under the predecessor Directive 95/46/EC) that a dynamic IP address was personal data. But in that case the web site was run by the German Federal Government, which surely has wider scope for getting info from a German ISP than a small private US web activist does. There is not yet any case law that I know of on the applicability of the GDPR to IP addresses in any case at all similar to the one in the question. Joe would in my view be wise to at least learn that logs are being kept, and post a disclosure of this on the site. Whether Joe needs to do more than that is less than clear at this time.
Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion. For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail. The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer". GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.
No. Art. 17(1) GDPR lists conditions when erasure can be requested. None of the listed grounds would apply in this case. However, you might have to explain why you process the data (for moderation purposes as you explained above), and why that is lawfully. In particular Art. 5 and Art. 6 need to be taken into account. In your case, processing will be based on Art. 6(1)(f): (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Even if the data subject would be a 9 year old child, the legitimate interests of you and other forum users outweigh the objection of the data subject. Based on Art. 5, there will be a moment when the data has to be deleted. For example 1 year after the last login attempt.
In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop. When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore. In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit. As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other. The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.
The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “[t]aking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons” (c.f. Art 24, 25, 32 GDPR). As of 2021, the state of the art for password storage is a special password hashing function such as Argon2, bcrypt, or scrypt. However, the nature and context of processing could reasonably lead to the conclusion that the usual hashed password storage is not appropriate, for example because the ability to find links between user accounts is more important. There is a trade-off between different aspects of security, and the data controller could reasonably arrive at an unusual conclusion. However: The data controller would still have to implement appropriate measures to protect these plaintext passwords, for example by storing them in an encrypted manner, keeping unforgeable access logs, and limiting access to plaintext passwords to specially trained staff. Encryption is one of the few things that are explicitly required whenever appropriate. The data controller better have a good analysis that shows that this unusual approach to security is appropriate. Even if not explicitly required, an Art 35 data protection impact assessment could be useful. The data controller has the burden of proof to show that these processing activities are GDPR-compliant. So is this data controller breaking the law or doing morally dubious stuff? Not necessarily! It is possible to find a scenario where they are doing the right thing. However, such a scenario is far-fetched and rather unlikely. Without further background, the most likely explanation is that the presented password handling scheme does not comply with GDPR.
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. That is not correct. According to GDPR Article 2: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. This Regulation does not apply to the processing of personal data ... ... (c) by a natural person in the course of a purely personal or household activity; GDPR Recital 18 states in relevant part: (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. Personal data that is not processed by &quot;automated means&quot;, for example data which is transmitted verbally, by hand writing, or by manually sent email, is not covered by the GDPR. Data which is used by a natural person for &quot;personal activities&quot; is also not covered. Consulting one's personal lawyer might well be a personal activity unless it is a business matter. Even if such a transfer of data were in scope for the GDPR, consent of the data subject (DS) is not the only available lawful basis. GDPR article 6 permits any of several possible lawful bases to be used, particularly paragraph 1 point (f) which reads: (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Also possibly relevant is point (c) which reads: processing is necessary for compliance with a legal obligation to which the controller is subject; In short, providing one's personal lawyer with the names and addresses of relevant people in connection with a legal issue is not at all likely to be prohibited by the GDPR, nor to require the consent of the people whose names and contact info are provided. However, a comment by user PMF reads: The Data Protection laws are mostly for companies, not for individuals. This is an overstatement. The laws do apply to natural persons as DCs, although enforcement is largely targeted at businesses, particularly large, for-profit businesses.
If I have correctly untangled the law, Schedule 2 of the Data Protection Act part 3 identifies as a condition where you are not prohibited from revealing personal data: The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract. The Animal Welfare Act 25(1) says An inspector may require the holder of a licence to produce for inspection any records which he is required to keep by a condition of the licence I can't tell if you are required to keep customer names, but if you are, it looks like the pieces fit together and you would have to provide the records. Call a solicitor to be sure, though.