Timeline for GDPR: Local encrypted database of non-identifiable information
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 20, 2020 at 9:11 | comment | added | Christiaan Maks |
Thanks for your replies. The most personal data that the database contains are filepaths that can include a username, eg C:\Users\Username which may or may not identify someone. Regarding "machine-readable", it is a common database but it is encrypted and the user does not have the key.
|
|
| Apr 19, 2020 at 10:31 | comment | added | wimh | There is nothing wrong if a software vendor sells software which is not GDPR compliant. However a user is not allowed not use that software for personal data processing if the GDPR applies (to that user). I agree that the OP is the controller. | |
| Apr 18, 2020 at 17:36 | comment | added | user28517 | @reed if what you say is correct, then Microsoft is a data controller and processor for anyone who uses Excel or Word locally and saves information out to local disk, or indeed is the same in any situation where a company uses SQL Server or a huge range of other tools, and that is not the case. | |
| Apr 18, 2020 at 16:09 | comment | added | reed | Let's just say that to give a more precise answer, we would need to know more details about the software: what it does, why it was developed, why the OP is using it, if they signed any contracts, etc. | |
| Apr 18, 2020 at 16:04 | comment | added | amon | @reed I understand that viewpoint, but think it leads to contradictory results when applied blindly. A software vendor will be a controller when they process personal data for their own purposes. However, they cannot be responsible for how the software is used – an operator of the software will be their own controller. There can be overlaps and they can be joint controllers. But I think it's necessary to look at individual processing activities, and determine the controller for that activity on a case by case basis. Thus, OP seems to be controller w.r.t. the database contents. | |
| Apr 18, 2020 at 15:52 | comment | added | reed | I don't think this is correct. The software vendor of course does control the purposes of the processing. It doesn't matter whether the software runs locally or remotely on a server, or where the data is stored. The data is processed by a software developed by a company, so that company must be a data controller (if the data can be considered personal data) | |
| Apr 18, 2020 at 14:53 | history | answered | amon | CC BY-SA 4.0 |