0

Article 25(2) of GDPR says the following (emphasis mine):

The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

I understand everything up to the section highlighted in bold. Who is the "individual" in "individual's intervention"? The user of the controller's website?

If yes, does this basically say that an individual user, whose data is stored by a controller, has the right to "intervene" and ask for his/her data to be deleted?

If yes, why does it say an "indefinite number of natural persons"?

I thought that you can only ask for your own personal data to be erased, not somebody else's.

Improve this question

1 Answer 1

Reset to default
2

Indeed, this is not drafted very well. But from context, it seems that the “individual” unambiguously refers to the data subject.

What this section says is that data controllers such as websites should provide privacy-friendly default settings. In particular, the user's data should not be public by default. The user may be free to change that, but it should be the user/data subject/individual's decision to enable public visibility. Of course, this is only required where “appropriate”, so this also depends on the context of the data controller's processing activities.

For example, consider a social network where users can add information to their profile at different visibility levels like “only visible to me”, “visible to friends”, or “visible to everyone”. Under Art 25(2) GDPR the default setting should be “only me” or “friends” but not “everyone”, though the user is allowed to change this.

As another example, consider a pastebin-style site where users can post text snippets in order to share them via a link. Under Art 25(2) the site should not make the snippets accessible to anyone, for example by identifying snippets by sequential ID numbers or by instructing search engines to crawl the snippet, unless the user has given consent.

The term “indefinite number of natural persons” instead of “the public” might help avoid misunderstandings for example in cases where an online platform is not open to the public (e.g. account registration is required), but the data subject still doesn't know who specifically would have access to their data.

Improve this answer
3
  • Your explanation is excellent. Now I realize that what has confused me is the order of collocations in the sentence. They really should have placed to an indefinite number of natural persons before without the individual's intervention, to make it clear that the to preposition connects to the accessible adverb.
    – Paul Razvan Berg
    Commented Sep 30, 2022 at 15:21
  • @PaulRazvanBerg One tip I can give in that context is to look into translations of the law, if you're multi-lingual. The EU translators go to great effort to ensure that all translations say exactly the same thing, and even use the same grammatical structure. But especially English doesn't do well with complex grammatical structures.
    – amon
    Commented Sep 30, 2022 at 16:15
  • That's a great tip, thanks, didn't think about looking up the Romanian version of GDPR (Romanian is my native language).
    – Paul Razvan Berg
    Commented Sep 30, 2022 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .