Hacker News Reader

Comment by jeremyt | Hacker News Reader

Great, so now we get to spend money on lawyers and time in the courts to decide what information falls under “OK to keep for a good reason”

View on HN

I couldn't agree more. The rules about erasure are full of holes like this. So are the rules about legitimate interests. And those represent, respectively, probably the most significant new subject right and probably the most common lawful basis for processing that isn't strictly necessary for some sort of legal compliance.

No, if you say you need the information for tax purposes (say) then the user will complain to the data protection authorities. These authorities will then accept or reject the complaint, and if accepted will help you to come into compliance.

The trouble is, that's an assumption on your part, and it might not be a valid one. We have no idea yet how 28 different regulatory authorities will handle this sort of situation, or how much of an effort they will expect controllers and processors to make on their own if they are to receive the benefit of the doubt. And even if everything you assume proves to be correct, any formal interaction with authorities is stressful and expensive for a small business with limited time and resources available, and being confident that you aren't doing anything wrong in the first place is obviously preferable.

A simple example: another law requires it.

Your bank's requirement to verify a chargeback is not a law. It's a business contract.

And therefore saving the data is allowed.

Not necessarily. The performance of contract basis under the GDPR is for contracts with the data subject. You can't just agree a contract with some arbitrary third party and use that to circumvent any subject rights you don't like.

For data processing purposes like this, you will normally have to rely on the legitimate interests basis. That's the one with the almost entirely non-specific definition, combined with the almost entirely non-specific balancing requirements.

With a case like defending an unjustified chargeback, we might assume that the interest is surely both legitimate and overriding, but even that is only a personal view and not something any regulator has explicitly addressed in guidance, as far as I'm aware. In any case, plenty of other scenarios won't be so black and white.

Reply on news.ycombinator.com