> financial services company, is probably obligated to retain records. GDPR defers to these obligations.
Gee - how long until the GDPR-o-crats demand a fine from a company (possibly the "right to be forgotten" thing), and the company then uses the defense that "we would have destroyed the information, except for some other EU regulation.. You figure your own way out of that logical puzzle!"
> Is your customer data on a server that automation can tamper with? If so, is a copy periodically written to a write-only destination?
Wait, so now we should have customer data in more locations?! I'm not disagreeing at all - except that that seems directly contrary to the "intent" of the GDPR in the first place (though you could cynically say that the real intent of the GDPR was to raise money, employ bureaucrats, and shake down mainly-U.S. companies.
Maybe someone should organize a campaign to flood the European GDPR Regulators with "our data might have been compromised already or maybe in the future, and might have contained data on EU residents, that might be considered 'sensitive' We are - (or will be) - working on it, but just wanted to let you know immediately so that you can't say we didn't warn you and slap us with a ga()-illion dollar/euro fine.." () “Ga” subject to change at any moment based on ECB forecasts, or how much we don’t like you.
All kinds of companies, from all over the world (eu or not) flooding the GDPR headquarters in Brussels with "pre-emptory warnings". The purpose of course being to let them know how ridiculous (and possibly/probably arbitrary) their regulatory framework
And is anyone else annoyed that since GDPR started, every single website that even so much as stores your username now has a "this website uses cookies" thing you have to click on to get rid of it? And if you turn off cookies, you see this damn intrusive thing every single time. How is this making the web "safer"?! Can "we" (whatever that means) petition them to enact a standard where people can set a preference in their web browsers that says "I don't care unless it's financial/medical/physical-address data" It's a $#%$5# pain in the collective derriere.
I wouldn't be surprised if some websites are doing it as a matter of course, "just in case" - like the "this product contains things that are known to cause cancer cause cancer to the state of California" - applied to everything - in a catalog that sells drill bits (okay, I suppose the couple of nano-grams of drill-bit-dust coming off it). Just to be safe (pun unintended).
Gee - how long until the GDPR-o-crats demand a fine from a company (possibly the "right to be forgotten" thing), and the company then uses the defense that "we would have destroyed the information, except for some other EU regulation.. You figure your own way out of that logical puzzle!"