4

The GDPR gives users the right to have their stored data deleted.

How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by allowing a software to function)?


For example:

Assume a software ("aggregator") that aggregates and displays information from a social network, to provide a more useful dashboard and notifications than what's built into the platform.

Users of the social network authorize the aggregator to access, store and display their friends' activity, and the service then notifies them when something interesting happens. This would make the aggregator (more precisely, the entity behind it) a "data controller" under the GDPR, right?.

Now if a user's friend requests deletion of their data from the aggregator, can the aggregator claim a "legitimate interest" reason to not delete that data? Since omitting friend activity from users' dashboards/notifications would mean not fulfilling the contractual obligation to the aggregator's users.

As a compromise, would it be permissible to substitute deleted information with anonymous records, like "An anonymous user commented in your discussion", given a user can trivially reference the discussion on the original platform and identify this "anonymous" user?

  • 1
    Disagree with the "specific advice" - the question boils down to the nature of online social interactions with multiple parties. That's common enough. – MSalters Jan 20 at 8:33
  • @MSalters: Yes, I believe this is fundamentally a good question. I edited to make it more general and less about "specific legal advice". Hope that's enough to get it reopened. – sleske Jan 20 at 10:15
  • 1
    To the OP: I reworked your question to make it more general and to avoid the problems with asking for specific advice. Please re-edit if I got something wrong. – sleske Jan 20 at 10:16
  • the latter (replacing the GDPR sensitive data with anonymous placeholders) is the usual solution to the problem you're describing. Without it it would be next to impossible for many software companies to function with anonymised test data to try to reproduce production problems too. – jwenting Jan 20 at 12:03
  • @jwenting - The usual solution does not include a reference to the original, non-anonymous dataset. As the OP pointed out, linking the two would, in many cases, be trivial. – Ruther Rendommeleigh Jan 20 at 16:34
1

I think in the example you mention, the aggregator is the controller because it "determines the purposes and means of the processing of personal data", see Art. 4(7). Typically the aggregator would be a joint controller with the user, however the user probably uses this for purely personal reasons only, so the GDPR does not apply to the user.

That would also mean, the controller is required to inform the data subject where that is feasible.

The GDPR gives users the right to have their stored data deleted.

Only in some specific situations. See this answer for more details. In this situation it boils down to whether Art.21(1) applies:

  1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

It is difficult to say whether such "compelling legitimate grounds" exist, but in this example, the aggregator processes data which is either publicly visible, or at least visible to the user which receives the information. So as long as the user is able to get the data also in a different way, there are not much rights taken away from the data subject. So I would say that the controller has a compelling legitimate ground to process the data. Of course, the aggregator may not use the data for other purposes, unless it also has a compelling legitimate ground to process it for that purpose.

However if advanced data analytics like profiling is done on the aggregated personal data, it may shift towards having no compelling legitimate ground to process the data.

|improve this answer|||||
0

Users of the social network authorize the aggregator to access, store and display their friends' activity, and the service then notifies them when something interesting happens. This would make the aggregator (more precisely, the entity behind it) a "data controller" under the GDPR, right?.

Not quite. What happens here is that you process the friends' data on behalf of your users. They are the data controllers. Being merely at your users' service, you are only the data processor.

Now if a user's friend requests deletion of their data from the aggregator, can the aggregator claim a "legitimate interest" reason to not delete that data?

That claim would be misleading the friend into thinking that the aggregator is data controller here. The correct response would be something along the lines "We keep your data at the request of your friend X. If you want us to remove your data, talk to them."

Note though that, as a data processor, you are required to keep the friends' data secure. And if you do it, the friends should not learn of you processing their data in the first place (other than from your users).

|improve this answer|||||
  • 1
    I agree that the user could be a data controller. But that doesn't mean that the service would be a data processor. By default they'd be joint controllers, unless they've set up a suitable legal relationship. – amon Jan 21 at 14:27
  • @amon So it's in the aggregator's best interest to setup that legal relationship so that it can avoid duties of a data controller. – Greendrake Jan 21 at 21:57
  • "They are the data controllers. Being merely at your users' service, you are only the data processor". Not true, unless by "users" you mean something other than "users of the social network". Users don't store data, don't delegate data, and don't even control their friends' activity in the social network. Their usage of the social network might be only for personal or domestic purposes, in which case they are not even subject to the GDPR. – Iñaki Viggers Feb 7 at 17:51
  • @IñakiViggers I mean users of the OP's aggregator software. Yes they are also users of the social network, but it's them being users of the aggregator that makes them data controllers because by virtue of deciding to use the aggregator they effectively "determine[s] the purposes and means of the processing of personal data". Note that controllers don't need to store data. Processors do (which the aggregator does). – Greendrake Feb 8 at 7:31
0

Do I have a “legitimate interest” under GDPR to not delete data my software needs to fulfil its function?

You don't need to posit a legitimate interest in the example you describe.

Articles 5.1(b), 89.1, and others of the GDPR explicitly authorize collecting/archiving/operating on personal data for statistical purposes. Aggregators serve a statistical purpose.

If practicable, the anonymization of personal data you propose at the end of your post would be optimal in regard to the principle of data mininization mentioned in article 89.1.

|improve this answer|||||
  • What the OP's aggregator does falls short of the GDPR meaning of "statistical purpose" (recital 162): "The statistical purpose implies that the result of processing for statistical purposes is not personal data, but aggregate data, and that this result or the personal data are not used in support of measures or decisions regarding any particular natural person." The data at the end of processing remains personal as the "anonymous" users in it can be easily identified by following a web link. – Greendrake Feb 9 at 2:30
  • @Greendrake For the GDPR to be applicable at all, the decisions regarding the particular individual would have to be beyond personal or domestic purposes. The OP's description nowhere indicates that that is the case. What the OP does indicate is that the purpose of his aggretator is "to provide a more useful dashboard and notifications [...] when something interesting happens". A dashboard and notifications hardly infringe a particular natural person's "rights and freedoms" the GDPR intends to protect. – Iñaki Viggers Feb 9 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.