Kath wrote:I'm getting involved in a compliance project for EU, called General Data Protection Regulation (GDPR.)
It's rather maddening and ridiculous. I get that they don't want us to hold onto a bunch of personal information after an employee leaves, but I have to go through every single table I have, identify which fields contain an employee ID and remove those. We're talking hundreds of tables with hundreds of fields containing an employee ID. (And that's just my system, I can't imagine what the folks in payroll and HR are going through right now.)
In addition, any documents that may be attached in my system will have to be checked to see if they reference a termed employee and delete the info, EVEN IF the employee is not one of OUR employees, but one of our CLIENT"s employees.
I asked, "so I'm supposed to open every single document in my system every day and call the employer and ask if these people still work there?" Answer? We don't know yet, anything is possible with the EU.
Lol.... what a nightmare. Any employee in the EU has the right to call a former employer and require the employer prove that they've removed every single thing that could identify them, even their work phone number, which is no longer a valid number.
OMG... can't prove a negative unless you give the former employee access to every single data point and every single document that exists in the company.
WTF Europe?
Yea, it’s a big deal over here as well. I’m not complaining to much since the company I work for makes a lot of money advicing on its implementation. The most important thing is to know what kind of information you have so you can delete personal records if you are required to. Also to be able to show that you have routines in place to regularly go over old stuff and delete anything containing personal data that isn’t used anymore.
It’s a bit of a chain letter as well since to be certified all your digital partners have to do the same work as well.
I personally think most of it is common sense and should have been common practice long ago but since it never was the EU felt they had to legislate.
The directive is very porly written from a lega standpoint. Swedish lawyers don’t even use the Swedish translation since the language in it is so far from the legalese they are used to so they use the English version instead.
The confusion is great and everyone is waiting in great anticipation for the first cases to be heard.
