1

There is a piece of software that has a database on my local computer. This database does not contain personally identifiable information but the contents are created by the user. However, this database is encrypted and the software company in question does not want anyone else to open this database. There is no other way to retrieve data out of this database other than using the software provided by the company (which provides no way to export the data in bulk).

My question is regarding the GDPR. Does this company have to provide a method to exercise your right to obtain a copy of your data? Article 15.3 says that it should however this might only be concerning personally identifiable data. That part is unclear to me. Article 12.1 says that the company should provide this data in a concise, transparent, intelligible and easily accessible form. A database (encrypted or not) does not comply with this.

Does this database of non-identifiable data apply to these GDPR articles? Or any other relevant articles?

Improve this question
1
  • 1
    I guess it all depends on whether the data can be considered "personal data" (any information relating to an identified or identifiable natural person) or not. If it's not personal data, GDPR does not apply. If it is, you should have the right to receive the data in a "structured, commonly used, machine-readable and interoperable format" (article 20). A database dump in SQL format would be fine.
    – reed
    Commented Apr 18, 2020 at 15:42

2 Answers 2

Reset to default
2

If the data isn't personal data as defined under Article 4 then the GDPR's right of access doesn't apply to it.

Article 15.3 says (my emphasis) "The controller shall provide a copy of the personal data undergoing processing. ..."

It has a footnote or cite to Recital 63, which says (my emphasis): "A data subject should have the right of access to personal data which have been collected concerning him or her ..."

The GDPR is about "the protection of natural persons with regard to the processing of personal data..."

Without knowing more about the database in question, we couldn't say whether it does in fact hold personal data or what other rules may be relevant.

Improve this answer
1
  • Thanks for your insights. I think the emphasis on "personal data" is important. The most personal data in this database are filepaths on the users' computer. That can identify someone based on the username that is in the filepath, eg C:\Users\Username. It depends what the username is but it can certainly be identifiable.
    – Christiaan Maks
    Commented Apr 20, 2020 at 9:05
1

I am doubtful that the GDPR applies here. The software vendor would have to be a data controller for data subject rights to apply. This is only the case when they control the purposes and means of processing for some personal data. However, they do not seem to control the purposes for which the data in this database is collected – you control the content yourself. This would e.g. be different if they collected usage data in the background.

Even assuming the GDPR did apply, your right to Access has been satisfied since you can use the application to inspect the database contents. The Access right does not imply a bulk export. For that, we would have to look at the Art 20 right to Data Portability. But since your database is stored locally, I don't think you have provided any data to the controller. That right is also linked to certain legal bases of processing. Also, the database file itself possibly satisfies the requirements of the article: while it's not a commonly-used interoperable format, it is machine-readable[1]. Per Recital 68, the right to Data Portability “should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible.”

[1]: This possibly depends on what you mean with “encrypted”. Binary formats are machine-readable. Encrypted files are machine-readable if you hold the key.

Improve this answer
6
  • I don't think this is correct. The software vendor of course does control the purposes of the processing. It doesn't matter whether the software runs locally or remotely on a server, or where the data is stored. The data is processed by a software developed by a company, so that company must be a data controller (if the data can be considered personal data)
    – reed
    Commented Apr 18, 2020 at 15:52
  • 1
    @reed I understand that viewpoint, but think it leads to contradictory results when applied blindly. A software vendor will be a controller when they process personal data for their own purposes. However, they cannot be responsible for how the software is used – an operator of the software will be their own controller. There can be overlaps and they can be joint controllers. But I think it's necessary to look at individual processing activities, and determine the controller for that activity on a case by case basis. Thus, OP seems to be controller w.r.t. the database contents.
    – amon
    Commented Apr 18, 2020 at 16:04
  • 1
    Let's just say that to give a more precise answer, we would need to know more details about the software: what it does, why it was developed, why the OP is using it, if they signed any contracts, etc.
    – reed
    Commented Apr 18, 2020 at 16:09
  • 2
    @reed if what you say is correct, then Microsoft is a data controller and processor for anyone who uses Excel or Word locally and saves information out to local disk, or indeed is the same in any situation where a company uses SQL Server or a huge range of other tools, and that is not the case.
    – user28517
    Commented Apr 18, 2020 at 17:36
  • 1
    There is nothing wrong if a software vendor sells software which is not GDPR compliant. However a user is not allowed not use that software for personal data processing if the GDPR applies (to that user). I agree that the OP is the controller.
    – wimh
    Commented Apr 19, 2020 at 10:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .