If data is stored in human memory, is the GDPR applicable?
Say, an employee of a company remembers an email address of a client, their date of birth, or even what their face looks like, does the client have a right of access to this data, or even a right for this to be erased?
GDPR forces companies and employees to keep personal data confidential and to use it only for its allowed uses. That obligation continues after the work contract ends.
If the employee breaches confidentiality, it does not matter if he provides the data as a file in an USB-drive or if he provides it from memory; it is a breach of confidentiality.
Access logs will help to determine which employees have had access to your data, in case a leak is suspected.
The part of the question about human memory seems to come from a deep misunderstanding of how human memory works1. I can remember tomorrow something that I have totally forgotten now. Even worse, there is no telling of what can make me remember you; your name might not ring a bell but I may remember you by seeing someone walking a dog. And nobody will ever be able to tell if I have complied with any of your requests or if I am just lying.
And of course, there is only one proven way to erase memories, and I am pretty sure the GDPR does not allow for the execution of employees (Disclaimer: IANAL and IANYL, check with a lawyer before murdering anyone if you have doubts).
No.
The GDPR only applies to "processing" of personal data. What happens inside the human mind is not "processing" as defined by the GDPR - so there is no right to access and no right to erasure, etc.
