GDPR - Right to erasure - Conflicting laws I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to as "Forget me". My assumption is that the functionality will have to consist of a mix of deletion of records and anonymization. Especially where there are transactional data that cannot be deleted or for that sake cannot be legally deleted. Another assumption about the procedures is that the end-user will have to be notified in advance about the "Forget me" job with a date and time. It would be impossible to notify after the job has been done, because then you would need the information that has just been erased. Of course if the customer calls at the date given then customer service would have no records of this customer and would not be able to search by any information given. Accountability? In this respect what about all logs of work done? Emails sent would necessarily have the mail-to address stored. I believe there is a conflict of laws, you are legally bound to keep log of messages since it documents work done, but on the other hand you cannot know who this person is. You could anonymize the email address, but then again what about the content of the communication? Backups? Does the law also mean that backups will have to "Forget"? That would be very impractical with write-once or streaming type media. How about backups prior to 2018? Backups may legally have to be stored for 10 years, but some would want to store them even longer.
Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion. For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail. The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer". GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.
Not going to hold up. Dutch Supreme Court confirmed 2012-09-21 in LJN BW6135 that arbitration is still covered by the the right to an independent judge, as established in Golder v UK, ECHR 1975-02-21, nr. 4451/70. Stack Exchange can't decide the rules themselves. (The Dutch case confirms that sector-wide arbitration is in fact legal, with regard to a standard arbitration clause commonly used in the Dutch building sector. The arbiter was found to be independent in that case precisely because they weren't picked by the builder involved.) The GDPR is only indirectly relevant, but the fact that it's mentioned does mean that there is an indisputable intent to provide services to EU consumers. (See section 23 of the GDPR, or its national equivalents). As such, you can't hide behind a US business address. If you intend to do business in the EU, it's under EU laws - all of them. You can't say that only the GDPR applies, and not other rules. I'm having a bit of a problem finding a source, but I'm fairly confident that consumers have the right to sue at their own, local court, overruling the default of suing in the court where the counterparty is located. Finally, I have the right under national law (Dutch: BW 6:236 start and sub-n) to strike the arbitration clause up to 30 days after the conflict arises, and demand a court decision. That's not 30 days after I accept the "Public Network Terms", that's 30 days after the arbitration is invoked. Dutch law explicitly allows arbitration abroad, and arbiters may apply foreign law, but as written the arbitration clause has no legal basis in the Netherlands, and any arbitration resolution would therefore not be considered valid. You may wonder if it matters to Stack Exchange that the arbitration decision would not hold in the EU. Well, consider a clause like Indemnification, which demands the user indemnifies Stack Exchange. That's a pretty empty demand if it's not enforceable.
The GDPR actually does require you to follow DNT in Article 21: In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. I think this is quite explicit.
Is the their username alone, without any attached profile (like their email address or real Name) still considered personal data that has to be deleted? For something to be ‘personal data’ it must information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. In other words: If the natural person can be indirectly identified from the username, it is personal data. If he cannot, it is not personal data. This obviously depends on the circumstances. If the user used something very similar to his real name, or his email address or uses the same nickname on a lot of different systems, then it probably is personal data. If it is an unique pseudonym that is not used elsewhere, it is less likely. If you want to make sure you comply with the right to erasure, you may want to scrub your wiki database, replacing all the username of the deleted user with "anonymous" (or something like that). If you want to be able to treat these as separate users, your scrubbing process may use unique anonymous identifiers ("anon-1", "anon-2", and so on).
The data processor is not responsible for complying with the GDPR. You are ultimately responsible, since you are the data controller. The data processor is merely required to assist you, but it's unclear what that means in the presented scenario. Per Art 28(3)(e) GDPR, the DPA must require the data processor to provide reasonable assistance: That contract or other legal act shall stipulate, in particular, that the processor: […] taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III; However, per Art 28(1) you can only engage processors that you deem sufficient to protect the data subject's rights: the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. Here, it seems that your company failed to ensure that the processor provides the features you need for compliance. Many companies claim to be GDPR-compliant, but that doesn't mean that your use of their services will be GDPR-compliant as well. Depending on how the Art 28(3)(e) requirement was implemented in the DPA you may have a right to assistance even if the processor doesn't implement necessary features in their software, but enforcing this contract could require a lawsuit in a foreign jurisdiction (but that's par for the course for international B2B contracts). It is worth noting that the GDPR right to erasure doesn't always apply. In a processing activity where no erasure right is likely to arise, it would be perfectly fine to use a data processor that doesn't offer any possibility for erasure. Similarly, it can sometimes be legal to use technologies like Blockchain or Git that make erasure difficult or impossible. However, it is the responsibility of the data controller to analyze the impact of such a choice up front, before commencing the processing activities. In some cases, this could require a Data Protection Impact Assessment (DPIA). Note that transfers of personal data into the US are illegal or at least questionable in the wake of the 2020 Schrems II ruling. The Privacy Shield is no longer a legal basis for such transfers. Standard Contractual Clauses (SCCs) are technically allowed, but only “on condition that enforceable data subject rights and effective legal remedies for data subjects are available” (cf Art 46). The ECJ's judgement calls this into question. This could be a further incentive to migrate to a more GDPR-compliant service.
The GDPR doesn't generally distinguish public from non-public personal data. If you have a good reason to contact the professor, do send them an email. GDPR does not prevent this. If you're sending this email for “purely personal or household purposes”, then GDPR doesn't apply anyway. There are rules in the ePrivacy Directive against unsolicited emails, but these specifically relate to emails for direct marketing purposes. A company is not allowed to send out spam marketing, regardless of whether they obtained the email address from a public data source. Companies can send email marketing to their own existing customers, or to people who have given consent. Consent is defined in a fairly restrictive way (as a specific, informed, freely given, and unambiguous indication of the data subject's wishes), so that mere publication of an email address cannot be interpreted as consent to receive marketing from a particular company.
Why is a business allowed to refuse a customer? Because also freedom of contract is a right. Except for discrimination on the basis of protected categories, a person or entity is entitled to discretion on whether or with whom to do business and enter contracts. The last sentence in your post reflects a misconception of "completely different set of values and laws" between the USA and members of the EU. Clearly there are many differences, but a comparison of the Wikipedia link you posted and, for instance, 42 U.S.C. § 2000e-2 reflects an overlap of protected categories in the laws of the Netherlands and of the US, such as religion, sex, race, or national origin/nationality. One would need persuasive evidence to support a finding of unlawful discrimination in the two examples you have experienced. Assuming the bank responded to your GDPR inquiry truthfully, the bank's refusal to open an account might have stemmed from profiling or decision-making that (1) does not precisely require specific data about you, and/or (2) uses information the bank does not need to log for purposes of compliance with the GDPR. Note that the GDPR does not outlaw algorithmic decision-making. Since legislation in the EU (as in the US) portrays an approach of market economy, both bank and landlord are entitled to made decisions on the basis of their inner policies for risk management. The policies might be unclear to you, but that does not necessarily mean they contravene principles of equal opportunity.
Note that the answer to most of your questions has nothing to do with the GDPR specifically, but has to do with the legal force that an EU Regulation has. Here's a related answer on EU Regulations vs. Directives. That said, here are my answers to your specific questions: So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception? Yes. Are there any other exceptions? Yes. Scanning the Regulation for instances of "Member State" is a good way to find them. In my opinion, the biggest area of the GDPR where Member States have influence is Article 6, "Lawfulness of Processing". In some circumstances, it allows Member States to specify what could be considered a lawful basis for processing. Must these exceptions be explicitly stated in the GDPR? Yes. As a Regulation, exceptions must be explicitly stated in order to be permissible because Member States have no authority to overrule EU law*. I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws. "Amended" is a fuzzy term. It can mean adding, changing, or removing from the law. Unless otherwise specified, Member States could not change or remove provisions, but there could very well be additions consistent with the GDPR. *Some Member States dispute this statement when it comes to constitutional issues.