GDPR Compliance - Password Protected Documents in AutoRecovery I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR. In order to maintain compliance with the regulations while preserving the ability of our team to work on the same spreadsheets, we have hidden sheets and locked the Excel workbook every time it has been saved. This effectively obscures all personal data behind password protection. A problem I have noticed however is that once the spreadsheet is unlocked and in use, MS Excel makes &quot;AutoRecovery&quot; copies of it which are accessible upon opening Excel. I wanted to check where things stand under these circumstances - of Excel autosaves effectively leaving a copy of the document without password protection. I presume this is non-compliant, if this is the case, is the only way around this to turn off autosaving and recovery mechanisms from Excel (providing this is possible)? Many thanks for any answers to what I hope is a fairly clear-cut question, but I can't be sure of my assumptions on the matter.
What does your Data Protection Officer say? It’s their role to be aware of and assess if you policies, procedures and processes comply with the principles. For the particular application is it: “specified, explicit and legitimate purposes”? “adequate, relevant and limited to what is necessary” “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures” And can you clearly demonstrate compliance with the above? Just a personal observation: WTF are you using a spreadsheet for what is clearly a database problem? This is several dozen steps away from best practice data security.
In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop. When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore. In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit. As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other. The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.
I cannot speak for civil law systems (Germany) but in Common Law (UK, USA) systems the law looks at substance rather than form. So: Am I allowed to undo the word-wrapping of all the texts and unindent them, as well as performing a new word-wrap on them? Yes Do I have to make sure that it is readable for everyone on every device, and do I have to make sure that accessibility interfaces are used (e.g. for blind persons, which aren't even the target group of my software)? If they are licences (rather than contracts) they must simply be available; this does not mean universally available. Do I have to make sure, that if my application wouldn't even start correctly on a device, that the user is able to start the application in an impossible, absurd, magic or religious way to ensure that he can read the legal texts or is it enough to state it on the website then? It depends if you want the licences to be enforceable by you on the users or if you are simply complying with your disclosure obligations. See What if the user disagreed with the Terms of Service, but still registered on a website?. Do I have to make sure that the rendering of the licenses/privacy policy/impressum is performant (e.g. text rendering and refresh after scrolling takes less than a second)? I already have to include two external libraries with my software to display the texts, otherwise it would not be possible to display texts at all. No - make them wait if you want.
You are correct that facts in general are not protected by copyright, and most raw data are facts. However, a collection of data may be protected by copyright as to its selection and organization. A use which copies such selection might possibly be copyright infringement. If data constitutes a trade secret it may be protected as such, and &quot;improper&quot; access might be unlawful. This would not apply to publicly available data or collections of data. If, to access a data set, one must sign or agree to a contract, that contract may limit the use of such data. Again, this would not apply to most publicly available data.
Maybe not. The ICO says that The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data. It might be valid to interpret the DPA / UKGDPR in a way that the relevant personal data undergoing processing in their system is the existence of the letters, but that you are not entitled to a copy of the letters. This is in line with the purpose of the right to access, that you can check what data they are processing about you and whether it is correct. If that argument holds and the data subject insists on receiving a copy of the letters, it might be legitimate to charge them a fee for these copies. But in practice: The data controller might not make this argument and just hand over the copies. It is worth a try. A right to access founded in data protection might not be the only way to receive a copy of these materials. If the letters are relevant for legal proceedings, they could perhaps be requested during the disclosure process.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
Since your consent is not required in Texas, revocation is irrelevant. Restrictions of use of recordings flow from the legal nature of the recording itself, so there is no provision saying, for example, that only one party needs to consent for just recording, but all parties must consent to make any use of the recording. Since these laws were devised to regulate the practice of wearing a wire and collecting evidence of crimes, requiring consent from all parties would be counterproductive to the purposes of the law. You could try drafting a contract where you pay people to not record you (anybody who doesn't sign, you shouldn't talk to them), but enforcement could be tricky, so I would not try a DIY contract: get a lawyer. You would have to show that you were harmed by them making an unconsented recording. It should be in the form of a contract where you give something of value in exchange for something of value, which is a thing typically enforced by the courts. Also bear in mind that even in an all-party state, if you know that you are being recorded, you cannot just say &quot;I do not consent&quot;, you have to stop talking. Continuing to talk when notified that there is or may be a recording constitutes implied consent, which is why on the phone companies often announce via recording that the conversation may be monitored, and they do not ask &quot;Do you consent&quot;. By not hanging up, you consented.