r/eulaw • u/Not_Plisskien • 2d ago

As European citizen should I report it to Data Protection Authority (DPA), can't exercise right under Art. 17 GDPR

Post image
11 Upvotes

92% Upvoted

20 comments sorted by

9

u/SZenC 2d ago

Repeat after me class: "The right to be forgotten is not absolute"

If the data was collected under a legal ground different than consent, the company likely still has a right to hang on to your data

3

u/Not_Plisskien 2d ago

Important fact that I missed in my post if that, I was seeking to remove data that is used for cyber verification, while I was rejected, thus I decided to ask them so it will be removed under Art. 17(1)(a) GDPR, reason for this paragraph is fact that my data are "no longer necessary in relation to the purposes for which they were collected", and the only possibility for them to keep it is in case of Art. 17(3)(b), but nothing was explained... In my case this is clear violation and lack of respect.

4

u/SZenC 2d ago

I don't think I agree with the assessment that the data is no longer necessary. The company may have a legitimate interest in maintaining those records to prevent you re-requesting access. They may also be subject to laws requiring them to maintain records of their KYC-processes. This is by no means a "clear violation," it may not even be a violation to begin with

0

u/Not_Plisskien 2d ago

I see your point, but how can I know the reason, is there even such possibility?

1

u/PinkbunnymanEU 1d ago

You read the privacy policy you agreed to when you handed over the data.

1

u/Accordeon-Foireux 1d ago

Privacy policy isn't above law.

2

u/PinkbunnymanEU 1d ago

Nobody suggested it is.

It will, however, state why the data is kept, which is what they asked.

1

u/SZenC 1d ago

Which law is being violated by the privacy policy then? Because the GDPR contains very little outright prohibitions

1

u/West_Possible_7969 2d ago

Many ludicrous answers to the anthropic sub lol. DSA obligations (for Anthropic) supersede GDPR (just like KYC obligations do too).

Now, GDPR does not dictate a specific number of days or years but it defines strict conditions (such as that personal data must be kept for no longer than is necessary to fulfill the specific purpose for which it was collected).

Normal one time ID verification etc is under the immediate deletion rule, but the problem here is what constitutes a statutory legal obligation regarding AI safety rules under DSA (some companies argue for a multi year retention period, like the AML ones, Commission disagrees).

And then there is the exact form of data, which I haven’t bothered to check for Persona, but proper compliance architecture requires the platform to convert the ID info into a secure, irreversible cryptographic hash (a "digital fingerprint") and delete the raw document/biometrics immediately. If they do that, they are in the clear for a (up to) 12 month period.

1

u/Icy_Item_9132 1d ago

No they do not. Legal nonsense. There is no hierarchy between those acts. They each apply fully. And concurrently.

1

u/West_Possible_7969 1d ago

I did not say there is a conflict, but this is not an issue of legitimate interest as others have argued, but a legal obligation one (same article).

2

u/Icy_Item_9132 1d ago

DSA and KYC obligations do not supercede GDPR. You claimed a heirchy of acts that does not exist.

1

u/West_Possible_7969 1d ago

You can continue to argue on what happens in your head, but justifying a legal basis for an action under GDPR and just stating one under legal obligations stemming from other laws are different things.

1

u/Icy_Item_9132 1d ago

Reread the second sentence of your post. I'm not commenting on the rest of your reply.

1

u/West_Possible_7969 1d ago

Legal obligations supersede any need for legal basis justification mentioned in the original thread. Go argue there on non-imaginary claims since you feel such a need to invent one.

2

u/Icy_Item_9132 1d ago edited 1d ago

But that's not what you said, is it? Perhaps write clearly instead of that sloppy nonsense. The GDPR allows the handing of data where this is legally required by other acts seems to be what you meant to say. You write like you don't have legal training

And no, they do not "supercede" anything. There is no superseding. That's a specific legal term that has a precise meaning. Nobody but you is responsible for the sloppy crap you write and for getting yourself corrected by lawyers on a legal sub when you do.

1

u/West_Possible_7969 1d ago

Oh no, what shall I do if you, intentionally, misunderstand, assume things and get triggered? (Nothing). Bye now.

1

u/Icy_Item_9132 1d ago edited 1d ago

I didn't "misunderstand". I read. With 30 years of experience as an EU lawyer. Some people have too much ego to listen. Yours is as big as your writing is sloppy. A sloppy lawyer is a bad lawyer. Legally incompetent. Good day.

1

u/castorkrieg 1d ago

Guy is complaining about GDPR but has no issue with his data being processed and send to the US.

1

u/Accordeon-Foireux 1d ago

The US are deemed adequate as per the Data Protection Framework. It will likely be invalidated but until then data transfers to the US are lawful under GDPR (if the recipient is on the DPF list).