I am providing a B2B service where customer data of businesses are stored in an SQL table. As I never need to query for this personal data, the data at rest there is asymmetrically encrypted with the associated businesses public key.
Since the information is encrypted, I cannot query for any personal customer data.
Example of the customer table:
------------------------------------------------------------
| business | firstname | lastname | private-data |
------------------------------------------------------------
| 12345 | xXencryptedxX | xXencryptedxX | xXencryptedxX |
------------------------------------------------------------
| 12345 | xXencryptedxX | xXencryptedxX | xXencryptedxX |
------------------------------------------------------------
| 12345 | xXencryptedxX | xXencryptedxX | xXencryptedxX |
------------------------------------------------------------
| 12345 | xXencryptedxX | xXencryptedxX | xXencryptedxX |
------------------------------------------------------------
For a GDPR information request I would need to fetch every single entry (tens of millions), associate the private key of the linked business, decrypt every single entry and do a string comparison search for every entry.
Given the enormously high cost of processing the data, am I obligated to do so as per a GDPR information request or could I argue that this would be a disproportionate effort as per Article 14?
After all, I am demonstrating my willingness to ensure high effort security by voluntarily only storing it encrypted.