The data subject shall have the right to obtain [...] personal data [if it is being "processed"]
Therefore, all stored personal data should be available upon request.
Then does GDPR disallow the following scenario?
- You give me your personal data.
- I encrypt your personal data using a random encryption key.
- I store the encrypted data and assign it a random ID for reference.
- I give you copies of the encryption key and the ID and throw away my copies.
- You later provide the ID and encryption key to me and ask me to decrypt your data and perform some work with it.
Note a few things:
- Nothing about the encrypted data, encryption keys, IDs, work performed, logs, etc leaves any information which correlates to you. Only your unencrypted personal data does.
- Your personal data still exists the whole time--I'm storing it in encrypted form (has it been anonymized?).
- Your personal data is readily available, if you give me the correct ID and encryption key.
Importantly, I'll never be able to satisfy your request for all your stored personal data. It's technically impossible since I lack anything which correlates it to you, and I don't have any encryption keys. I would only be able to satisfy the request if you gave me all encryption keys and IDs that I have ever sent you.
A concrete example:
In order to sign into a website you must have a trusted email address. Email addresses take the form of [email protected], thus they are personal data. You sign in by providing this personal data and clicking a button. Clicking the button stores your encrypted personal data according to the scheme above and then emails you a link containing the reference ID and encryption key. You establish trust by clicking the link, sending the website everything it needs to find and decrypt your personal data. Then the website takes action on your personal data, signing you in. Incidentally, the encrypted personal data is single-use and expires, so it gets deleted after you are signed in or if it gets too old.
I realize the goals of this example could be accomplished a different way. But I hope it helps make the scenario clear.