From the article:
> ...have exercised our discretion under our Terms of Service to disable your account(s)
The language here implies that the account still exists in a suspended state, and is not deleted. If you're a european, under the GDPR they must give you all your data if you ask for it. Maybe this would include the reason they banned the account.
Otherwise, you can at least demand that they erase the data they're holding only to your disadvantage.
So complaints from user1 about user2 or customer service notes about user2 wouldn't be considered personal data of user2 and thus wouldn't fall under GDPR rules.
If this isn't the correct interpretation, I would appreciate a pointer to something in the GDPR that elaborates on this.
Why wouldn't it? If it's data about an identifiable individual then - by definition - it is personal data.
Furthermore, in the ICO's recent report into political parties' use of personal data[0], they expressed the following view:
"Our investigation found that political parties did not regard inferred data as personal information as it was not factual information. However, the ICO’s view is that as this information is based on assumptions about individuals’ interests and preferences and can be attributed to specific individuals, then it is personal information and the requirements of data protection law apply to it."
[0] https://ico.org.uk/media/action-weve-taken/2259369/democracy... p29
For example, consider a website that maintains a collection of birthdays for public figures derived from public sources (historical documents, news accounts, social media posts from the public figures themselves, etc.). In many jurisdictions the birth dates might even be available via public record searches.
Clearly the birth dates are "personal data" in the colloquial sense of the phrase, but I don't think that the data as held by the website operator would be subject to the GDPR provisions, right?
Personal data is _any_ information about an identified (or identifiable) natural person.
Article 14 explicitly talks about data not provided by the data subject, further clarifying that it is in scope.
* are my interview notes during the hiring process "personal data" subject to GDPR provisions (disclosure, destruction, etc). * are my business meeting notes with a contractor subject to GDPR?
It absolutely, positively does require that disclosure. Article 15 states:
"The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data"
"Personal data" is defined in Article 4 as:
"any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;".
If I have any information* that can be related to you by any identifier, directly or indirectly, it is personal data within the scope of GDPR. Server logs, invoices, customer service records, CCTV footage, emails between employees that mention your name or username, the whole kit and caboodle.
The definition of "processing" given in Article 4 includes storage.
The regulations would be a farce if I could hoover up data about you from third parties or through surveillance technology, but you had no rights over that data simply because you didn't provide it to me.
Does it refer only to facts about a person, or does it include opinions and business decisions made by the company about that person? If one employee tells another by email that they dislike a particular customer and asks to have them banned, is that the customer's personal information in itself?
1. Yes, when exercising your "right of access", companies would have to send you all the personal data they have on you, except when disclosing this information would harm others (ie: notes of your manager about your performance or the example you gave) The exception does not mean that they can blankly refuse to give you any data, only the "offensive" part must be refused. By definition, that is still considered personal data however. As M2Ys4U mentioned: inferred data is also personal data.
2. there is a case where you don't have to provide all information: the right of data portability only applies to data provided by the data subject.
3. Someone is referencing article 14 below. That is not the same as giving access to data. Article 14 specifies how a data subject must be informed about processing of his data when you've received the data from someone else. For example: you've received someone's info from a recruiter and you now want to process his data to see if this person is a valid prospect. The article works together with article 13 (how to inform a data subject on what you are doing with the data he gives to you directly). Together, these articles are the reason for 50% of the privacy notices of the last couple of months :-)
It might not unless the definition is really stretched. It's not data collected about you. Otherwise every email some employee sends discussing this situation would also need to be included.
It's quite obviously personal data within the definitions used in GDPR. It's information that can be related to a natural person; those two criteria are the only criteria that must be satisfied for data to be regulated under the GDPR.
https://gdpr-info.eu/art-4-gdpr/
>Otherwise every email some employee sends discussing this situation would also need to be included.
Yep. If the contents of those emails can be related to a natural living person by any identifier (name, username, email address, account number etc) then it's personal data.
Take Facebook as an example, when you request your personal data, they present what is linked in their database to you, which is of course not where anyone mentions your name. Who is to say that my name (Paul Smith) identifies me and not some other Paul?
That is what they mean with "indirect identification" in the link provided by jdietrich.