anonymisation/redaction of public website content as response to &#39;right to erasure&#39; An organisation runs some public email lists. These are archived, and the archives are also publically available from its website. A user of the mailing list asserts their "right to be forgotten" and asks that all personal data held by the organisation be deleted. The organisation redacts all references to A. Person having email address a.person@example.com (as well as other identifying header information like IP addresses) in the list archives, replacing them with Anonymous 12345, anon-12345@example.org, and so on, and retains no record of the mapping. Would this comply with the request? The organisation itself has no way to reverse the mapping, but clearly anyone who has received a copy of the message is able to do so. I am considering this in respect to Recital 26. If not acceptable, presumably there is no way to allow for archives to be maintained in the face of such a request other than by claiming exemption? (Is this perhaps stackexchange's approach? ie. delete personal data (accounts) on request but claim exemption on supplied content.) For electronic mailing list archives, one might also substitute tournament results; or the timetable of a conference that the person attended as a speaker.
I agree with Ben that there are many exemptions to the right to be forgotten. For example if messages are removed from a mailing list archive, the replies to deleted messages will become useless. That would impact the right of freedom of expression and information of those authors. That is one of the exemptions to the right to be forgotten. So there is no right to delete complete messages. Replacing references to names and email addresses, is a very good solution. It must not be possible to de-anomize the data. So having anon-20190213-123@example.org, it must not be possible to get back A. Person &lt;a.person@example.org&gt;. Sure, everyone who received a copy of those messages can find that message in their own archive, and see the author that way. But that is because they simply have a copy of the full archive. The right to be forgotten is independent of someone else having the same information you request to delete. For example google removes search results in its index, even though the same information can still be found on the original website. To fully exercise the right to be forgotten, you have to make a request to everyone who has that data. In Austria there is a recent case (ECLI:AT:DSB:2018:DSB.D123.270.0009.DSB.2018) (available only in German) where someone's data was anonymized after asserting his &quot;right to be forgotten&quot;. He did not agree and wanted his data to be fully deleted, so he filed a complaint at the Austrian DPA. The DPA denied his request. I have tried to make a translation of the relevant part of the judgment, note that many references are to other Austrian judgments or books (where I listed the ISBN instead). D.1 The binding part of the GDPR does not contain the term &quot;anonymisation&quot;. Only recital 26 states that the GDPR does not apply to anonymous data. D.2 The term &quot;erasure of personal data&quot; as used in Art. 17 is neither found in the binding part nor in the recitals. In Art. 4(2) erasure and destruction are listed as alternative forms of processing which are not necessary identical. This means that erasure does not necessarily requires final destruction. (cf. K121.375/0012-DSK/2008, with regard to Directive 95/46/EC, where also a distinction was made between erasure and destruction; cf. ISBN 978-3-406-72006-2). Such a differentiation also results from the case-law of the Constitutional Court (cf. VfSlg. 19.937/2014). Therefore, the person in charge is entitled to make a choice with regard to the means - i.e. the manner in which the data is deleted - (cf. again ISBN 978-3-406-72006-2, according to which reference is made to the destruction of keys or other decryption devices without the removal of the data itself; cf. in this sense also ISBN 978-3-406-71932-5, which refers to the impossibility of perceiving the information previously embodied in the data to be deleted; cf. also ISBN 978-3-406-72007-9, according to which deletion is to be understood as any kind of conceilment of stored personal data; cf. also Warter, Dako 2/2018, 39 [40], according to which the result of the deletion action is decisive). The removal of the personal reference from personal data (&quot;anonymisation&quot;) can thus in principle be a possible means of deletion within the meaning of Art. 4(2) in conjunction with Art. 17(1) GDPR. However, it must be ensured that neither the person responsible himself nor a third party can restore a personal reference without disproportionate effort (cf. RS0125838, according to which it is not sufficient to merely change the data organisation in such a way that &quot;targeted access&quot; is not possible any more; cf. also the judgment of the CJEU of 19 October 2016, C-582/14, 45 ff.). Only if the person responsible aggregates the data in a way that no data can be identified, can the resulting data stock be described as anonymous (i.e. without personal reference) (see Opinion 05/2014 on Anonymisation Techniques of the former Art. 29 Data Protection Working Party, WP216, p. 10). The Administrative Court has also ruled - with regard to the comparable legal situation under the DSG 2000 - that a redaction (blacking out), for example, can be regarded as a form of deletion. By making the name of the data subject and all other data relating to him or her unrecognisable, his or her request for deletion is complied with (cf. the decision of 23 November 2009, 2008/05/0079). So anonymisation is sufficient to comply with a right to be forgotten request.
In my opinion, you are totally free to publish the information. There are two areas of law that can be cosidered - private and public law. In the private law area, you can be liable for revealing trade secrets, but only if you agreed to keep them by a contract. Trade secrets do not exist by themselves (there are minor exceptions, eg. in competition law, but those do not concern us), they must be protected by contracts. Another private limitations, like libel laws, won't apply here. This is not uncommon, but not in cars - you can find clauses like these in software license agreements. Then there is the public area. Is there any regulation, any policy of the state, that prevents you from publishing it? I am not aware you whole legal code of your state, but I doubt there is. It would be a harsh limitation of freedom of speech. Even if the modification could lead to illegal effect (like, modifying toy weapon to kill by rising its power...) it would be only illegal under very rare circumstances. To conclude it - freedom of speech can be limited only if there is sufficient public interest to do so, and I don't see any.
In this specific case and location, the precise location of the incident was explicitly made a public space via state law not too long before this actual event. They therefore most certainly have no right to privacy. What is interesting to me though is the other side of this, does someone have the right to record others in public spaces, or is it simply not illegal? For instance if I non-destructively and non-violently "jam" your camera by shooting a low-power IR beam at your lens, have I abridged a legal right of yours? I don't think it would be illegal to do this. I am not even positive its against the 1st Amendment. The 1st Amendment relates only to the dissemination of information, not the collection of it. The Constitution doesn't seem to compel the gov't to make information available, or even to make things/events/spaces observable. The various "sunshine" laws after-all had to be enacted, it wasn't part of an interpretation of the 1st Amendment. To put a finer point on it, is recording events in public spaces legal or merely lawful?
Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: Assuming private messages contain personal data, if at least one of the following points (a..f) applies, it would have to be deleted. (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; The original main purpose was probably Article 6(1)(b) (performance of a contract). If you delete your account, that would no longer apply. However, for the receiver of the private message, Article 6(1)(f) (legitimate interests pursued by a third party) would apply. The receiver might still want to read that message. So there is still a purpose to process this data. So point (a) does not apply. (Note that a Facebook private message can be considered a hosted version of SMS messages. A receiver does not expect SMS messages to be automatically deleted after they have reached the recipient's device. A receiver expects full control of the storage of SMS messages. I think a receiver expects the same for messages on facebook.) (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; Data processing was not based on consent, so point (b) does not apply. (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); Article 21(1) allows you to object to processing based on Article 6(1)(f), unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject. While I think processing is based on Article 6(1)(f), I also think there are legitimate grounds to refuse your objection. As explained before, the receiver might still want to read that message. The receiver was able before to read your message, so one can assume he/she has already knowledge of the personal data in the message. As it is a private message, no one else will be able to read that message. (At least Facebook will not allow it). So if the message is not deleted, the privacy implications for you are low. That's why I think the interests of the receiver will prevail. However, in the end, a judge will be the only person which can make such a consideration. So you would have to got to court to get a final decision about this. Article 21(2) is for direct marketing, that does not apply to this situation. So I think point (c) does also not apply. (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; These points do not apply. (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). This data processing was not based on consent, so even if you are a child below the age of 16 years, point (f) does not apply. Article 17(2) and Article 17(3) wont help you either. So in my opinion Facebook is right in this case.
If a data controller fails to fulfil your data subject rights, lodge a complaint with your data protection authority. In Hamburg, the appropriate form is here. However, they are not required to investigate your complaint. Independently from a complaint, you could consider suing Wordpress for compliance – Automattic has a subsidiary in Ireland so this might actually be feasible. I'm not quite sure though that Automattic is indeed the data controller for wordpress.org, as opposed to the .com domain – the privacy policy isn't quite GDPR compliant. While your GDPR Art 17 Right to Erasure might not apply in this case, there's a definite GDPR violation because the data controller failed to respond to your request within a month as per Art 12(4). That your posts on the bugtracker were deleted doesn't look like an issue in this context, what does matter is that they didn't respond to emails to the addresses mentioned in their privacy policy. Whether you have a right to erasure depends on the legal basis for storing your data. In general, you have a right to erasure if: the data is no longer necessary; processing is based on consent (because you can always withdraw consent); or processing is based on a legitimate interest and they have no overriding legitimate grounds to continue processing despite your objection (Art 21). The data is still necessary to identify you for your actions on the bugtracker, but depending on your particular situation you may be able to object successfully and force them to anonymize your posts.
The general rule is that "public records" must be disclosed unless they are by definition not public records. This study summarizes US public records law on a state by state basis, if the issue is about the US. Taking Massachusetts as an example, the law defines public record here, so if the item is not a public record, it is not required to disclose the item. Clause 26 has a long list of exceptions such as (j) the names and addresses of any persons contained in, or referred to in, any applications for any licenses to carry or possess firearms issued pursuant to chapter one hundred and forty or any firearms identification cards issued pursuant to said chapter one hundred and forty and the names and addresses on sales or transfers of any firearms, rifles, shotguns, or machine guns or ammunition therefor, as defined in said chapter one hundred and forty and the names and addresses on said licenses or cards ... (o) the home address and home telephone number of an employee of the judicial branch, an unelected employee of the general court, an agency, executive office, department, board, commission, bureau, division or authority of the commonwealth, or of a political subdivision thereof or of an authority established by the general court to serve a public purpose, in the custody of a government agency which maintains records identifying persons as falling within those categories; provided that the information may be disclosed to an employee organization under chapter 150E, a nonprofit organization for retired public employees under chapter 180, or a criminal justice agency as defined in section 167 of chapter 6. (p) the name, home address and home telephone number of a family member of a commonwealth employee, contained in a record in the custody of a government agency which maintains records identifying persons as falling within the categories listed in subclause (o). If the information is not legally a public record, there is no obligation to disclose. There is a general requirement via statute, regulation and court rulings requiring the government to protect personal information, such as this. You can get a list of sources on that topic here. This does not mean that the government body in question can be forced to redact that information, but it is at least possible that there is a (slim) legal basis for requiring them to protect your privacy.
Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer. GDPR rights cannot be waived (mrllp.com). The last bit should have been: Therefore, in consideration of my participation in any project, I understand that retaining my name and email address, as described above, does not require my consent and that the right of erasure, as spelled out in the GDRP Article 17 (1) b does not apply. The legal basis for our lawful processing of this personal data is Article 6 (1) f ("processing is necessary for the purposes of the legitimate interests pursued by the controller"). I.e. there is nothing in the GDPR that compels GitLab to erase this information, but their waiver is bogus. Keeping track of individual contributions in a software projects is necessary for a number of reasons, including security (if somebody contributes code that jeopardizes security, you want to audit everything that person has contributed).
If you are worried that some secret will become public, you should find and meet with an attorney, not a financial adviser or other nonlawyer. Your attorney is able to shield your secret information from disclosure in ways other professionals cannot. Raise any credit score issues you're concerned about. In general, the public has a right to access judicial records. See Nixon v. Warner Communications, Inc., 435 US 589, 597 (1978) (noting that the right is rarely litigated and not clearly defined). That right is not absolute; some records can be sealed, which means that the public can't read them. Local rules govern when that happens. I don't think the existence of a civil lawsuit could be made secretly except in special circumstances. Likewise, the plaintiff usually must identify herself, except in special circumstances. A plaintiff should assume that everything about the lawsuit--who filed it, against whom, what evidence arises, the trial, and who wins and loses--will be public.