Hacker News Reader

Comment by guitarbill | Hacker News Reader

FFS, no. It's optional, you volunteered the data, and the data is used for it's intended purposes. This is still fine.

(What wouldn't be fine is scraping the guest book, and then using that info)

GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't see your data in a machine-readable format or delete it.

It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done.

Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)?

2) If you stick the original in the shredder, you are removing much more than just the requestor's data.

>1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)?

You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately.

>2) If you stick the original in the shredder, you are removing much more than just the requestor's data.

There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged.

https://gdpr-info.eu/art-5-gdpr/

> Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?

Sounds like a DDoS waiting to happen.

It does not have to be machine readable. GDPR is technologically neutral. If the medium of storage is paper, a data subject access request can be fulfilled on paper. For example, photocopy the page, redact the other names, and mail the copy to the data subject.

If the data subject access request is sent by email, you can take it a step further and scan and email that page. Still, it does not have to be machine readable.

Can you point me to the text in the GDPR says what you are saying? IANAL and there's a good chance I'm just misreading the GDPR, but doesn't Article 20[0] completely disagree with you? In addition, imagine the person with the guest list lost the password to their email after putting you on their guest list, and now you don't have their new email address to ask them for the data

[0] https://gdpr-info.eu/art-20-gdpr/

That's the right to data portability, which is your right to have your data with an electronic service transferred to another service in a machine readable format.

It has nothing to do with data subject access requests, which is encoded in Article 15: https://gdpr-info.eu/art-15-gdpr/

"Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form."

That does not mean machine readable.

1(b) of article 20 clarifies that it had to be machine readable where:

the processing is carried out by automated means.

If you run a hotel, you can presumably answer the phone, and a photocopier and a dark pen should be enough to comply with reporting and deletion requirements.

There are limits to which data can be requested to be deleted.

Reply on news.ycombinator.com