Consider a mailing list like mailman or listserv. The archives of these mailing lists, due to quoting, will contain names and email addresses. Now, the GDP Article 17, unless I am mistaken obliges whoever runs said archive to delete the archived mails containing. This is neither feasible nor desirable for most mailing list archives. Am I misunderstanding here or does GDPR make keeping archives absolutely unfeasible?
Now, the GDP Article 17, unless I am mistaken obliges whoever runs said archive to delete the archived mails containing. This is neither feasible nor desirable for most mailing list archives.
The right to erasure, aka. ‘right to be forgotten’ does not apply to all archived personal data.
Am I misunderstanding here or does GDPR make keeping archives absolutely unfeasible?
As always, it depends. For instance, you need to consider the nature of the archive, and the personal data you process.
If this is a publicly accessible archive, you should consider the purposes of the archive. If one of the purposes of the mailing list to facilitate freedom of expression and the right to receive information, then the archive will fall under the same exception as the online archive of a multi-user blog or online news site that publishes articles with a byline. I.e. the exception granted in GDPR Article 85 for freedom of expression and information.
However, while this exception may only apply to the bylines (and to natural persons whose names are mentioned in articles). It may not apply to the email addresses that appears in headers and in quotes.
We know that email addresses are collected from such email archives by automatic robots and then sold to spammers. This is illegal, but it happens and as a controller, you are responsible for it happening. So as a controller of an email archive, you need not be too concerned about GDPR Article 17, but you need be concerned about Article 25, which requires the controller to implement minimising the processing of personal data if there are no overriding interest that allows you to keep the personal data.
As you can see from from example from Google groups, Google has implemented this type of data minimisation-principles by scouring all email-addresses (that was original part of this archive when it was known as "DejaNews") from all mesasges.
If you are the controller of an archive, you still need to be concerned about non-GDPR legislation that may require erasure (e.g. defamation laws, and other laws that limits the freedom of expression and information).