GDPR: What data am I allowed to keep after a user requests deletion? I struggle to find an insightful article on what, specifically, I have to delete and what I don't have to delete when a user requests deletion of their data. Some things are obvious to me: personal information like name, email and any text/images/content they added etc. What's less obvious to me: Do I have to delete our internal user ID (never shown to anyone on the platform, except possibly to the user themselves)? Do I have to delete statistics about how this - after deletion anonymous - user used the platform, e.g. which pages they visited? They're on our own server.
Art. 17 GDPR, Right to erasure (‘right to be forgotten’) requires “erasure of personal data concerning him or her”. That’s all personal data. However, this only applies when this article applies. Section 1 details when this is and sections 2 and 3 detail limitations and exceptions to the right of erasure. For example, you would be allowed to keep financial records that you're legally obligated to keep. So, if they have the right, you have to delete all their personal data that is not exempted. Aggregate statistics and other anonymous data in the sense of Recital 26 are not personal data and don't have to be deleted. Whether the kinds of data you have mentioned would be sufficiently anonymous would require further analysis.
The intention of the GDPR is to minimize the amount of personally identifiable information (PII) you store. So the GDPR never tells you that you have to log certain events. The simplest way to make sure you comply with the GDPR is to simply not store any PII at all. But that might of course conflict with legitimate business interests and with other legal obligations you might have. So when you do store PII, then the GDPR regulates under which conditions you are allowed to store PII, for how long and what you are allowed to do with that PII. So when you receive a GDPR request from a customer to see their data, then you can say that you only have that one timestamp of their registration, because you didn't log their subsequent logins (assuming this is the truth). I hope your privacy policy says that you store all that PII on registration and that you have some good arguments why storing that information is a &quot;legitimate interest&quot; of your organization.
Artice §12(5) GDPR limits the right to access: Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. A request to request the filing that you acted on their request is already excessive, repeated and frequent requests could be acted upon by taking the not-acting steps or sending an invoice before any action is taken. Also, very frequent requests with overlapping times might be answered jointly. It would be good to inform the customer in the last answer granted for free, how often they requested information and that any further answer might incur such and such fees for compiling the information.
I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to: personal information published on the blog pages personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR) and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains) Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here. About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity". C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog. Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity. Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR). There may be other approaches apart from these 3, but that's a start for your considerations.
There’s no definitive list of what is or isn’t personal data, so it all comes down to properly interpreting the GDPR’s definition: ‘[P]ersonal data’ means any information relating to an identified or identifiable natural person (‘data subject’). — Article 4(1) In other words, any information that is clearly about a particular person. But just how broadly does this apply? The GDPR clarifies: [A]n identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. — Article 4(1) This means that because you say that coordinates and anticheat logs are linked to the cheaters ingame username and unique id, if there is a record of who that username and/or unique id belongs to, even if it is just an IP or email address, it is considered personal data because the information relates to an identifiable natural person. Personal data includes any data which can be linked to information where a person can be identified From CommentsIf the online username and unique id is not linked to the actual human (no stored real name, no home address, no IP), can the natural person actually be identified? The records and anticheat logs are linked to the unique id and username, however the unique id and username are (from my POV) not actually linked to the real human Only you can answer that question as it stands because we have no access to your data. From what you have told us, even though the coordinates and anticheat logs are linked to the cheaters ingame username and unique id, that alone doesn’t fall under the GDPR’s scope of personal data, as, in all likelihood, the usename and unique id could relate to anyone in the world. The issue comes if elsewhere you have a record of the person's name, IP, date of birth etc. which when combined with the anticheat logs could link that data to identifiable people. You might think that someone’s name is always personal data, but it’s not that simple, as the UK’s Information Commissioner’s Office document what is personal data (PDF) explains: “By itself the name John Smith may not always be personal data because there are many individuals with that name. However, where the name is combined with other information (such as an address, a place of work, or a telephone number) this will usually be sufficient to clearly identify one individual.” Note: A name which is much less common could be personal data as the likelihood of it relating to others deminishes. John Smith is a common name all over the UK, but what about a particular polish/czech/hungarian/french.... name (let's say) living in Nottingham, UK? What is the likelihood of another person of the same name in Nottingham, UK? Add a middle name or double barrelled surname, and it becomes even more likely that it is personal data. If you’re unsure whether the information you store is personal data or not, it’s best to err on the side of caution. This means making sure data is secure, reducing the amount of data you store, collecting only as much data as necessary to complete your processing activities, keeping data for only as long as it meets its purpose, and ensuring only authorised people are able to access the data.
Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time. Microsoft was one of the first (if not the first) to communicate openly about the GDPR and the changes that follow. From the blog post: If your organization collects, hosts or analyzes personal data of EU residents, GDPR provisions require you to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. To further earn your trust, we are making contractual commitments available to you that provide key GDPR-related assurances about our services. Our contractual commitments guarantee that you can: Respond to requests to correct, amend or delete personal data. Detect and report personal data breaches. Demonstrate your compliance with the GDPR. Microsoft is the first global cloud services provider to publicly offer you these contractual commitments. We believe privacy is a fundamental right. The GDPR is an important step forward to further clarify and enable individual privacy rights and look forward to sharing additional updates how we can help you comply with this new regulation and, in the process, advance personal privacy protections. Microsoft has set up an informational site on GDPR here. If your eyes are on any other provider, I think the only way to learn more is getting in touch and inquiring about their progress and process. Hope this helps.
Overview The GDPR requires data controllers (DCs) to exercise reasonable care when responding to an access, modification, or deletion request, to ensure that it comes from the actual Data Subject (person whose data is involved, here a DS). The GDPR does not specify just what methods must or may be used to ensure that an access (or other) request comes from the DS. It does say, in Article 12, that &quot;additional information&quot; may be requested from the DS by the DC for this purpose that is &quot;necessary to confirm the identity&quot; of the DS. If a DC receives data for identification purposes, it must be used only for those purposes, and retained no longer than needed. Personal Data (PD) in general must be limited according to article 5, so that data is used only for the purposes it was collected for, retained for no longer than needed, adn appropriately secured against unauthorized use or access. The DC is responsible for adhering to these limitations. Recitals 57, 59, and 77 (quoted below) confirm this, and discuss identification. If a DC violates these restrictions, it is subject to the same enforcement as it would be for violating any other GDPR provision. If a DS thinks the data requested to support identification of the DS is excessive, the DS may first complain to the DC, and then to the relevant supervisory authority if the response from the DC is not acceptable (allow at least 1 month for a response). But perhaps knowing that the GDPR forbids the DC from distributing or using this data except for the purpose it was collected, that is, to identify the DS, and from retaining it longer than need be, might offer some reassurance. A DS could also ask the DC what is the minimum data needed for identification, and redact data beyond this. The DC might need more than name and address, but not all that is on a bank statement or other ID document. GDPR Sources Article 12 (section 6) of the GDPR reads: Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. That includes access requests. Paragraph 1 of Article 11 reads: If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. Paragraph 1(b) of article 5 specifies that personal data shall be : collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; Paragraph 1(c) of art 5 specifies that such data shall be: limited to what is necessary in relation to the purposes for which they are processed ... Paragraph 1(e) of art 5 specifies that such data shall be; kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; [emphasis added] Paragraph 1(f) of art 5 further specifies that such data shall be: processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing Recital 59 reads: Modalities should be provided for facilitating the exercise of the data subject’s rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests. Recital 57 reads: If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. 3Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. Recital 77 reads: Guidance on the implementation of appropriate measures and on the demonstration of compliance by the controller or the processor, especially as regards the identification of the risk related to the processing, their assessment in terms of origin, nature, likelihood and severity, and the identification of best practices to mitigate the risk, could be provided in particular by means of approved codes of conduct, approved certifications, guidelines provided by the Board or indications provided by a data protection officer. The Board may also issue guidelines on processing operations that are considered to be unlikely to result in a high risk to the rights and freedoms of natural persons and indicate what measures may be sufficient in such cases to address such risk.
No, a company cannot suspend your GDPR rights – contracts can't override the law. Your rights as a data subject apply as long as your personal data is being processed. However, there is no requirement in the GDPR that they fulfill your data subject rights through a self-service mechanism like a “download my data” button. They can require you to use another support channel. (But Google offers infamously bad support.) In some cases, the service may legitimately decide that they cannot give you access to the data, for example if they believe that you are not the actual data subject (e.g. if they think that you hacked the account). The right to access must not adversely affect other people (Art 15(4)). If they have doubts about your identity, they can require further information to verify you (Art 12(6)). If your requests are excessive or unfounded (if you are spamming them), they can also turn down the requests (Art 12(5)).