TenthFleet:GDPR: Difference between revisions

(3 intermediate revisions by one other user not shown)

Line 10:

==The right to erasure, and why it is not absolute==

Under Article 17(1) of the GDPR, a person generally has the '''right to erasure''' (sometimes called the "right to be forgotten"): the right to ask an organization to delete personal data it holds about them.

Under Article 17, paragraph 1 of the GDPR, a person generally has the '''right to erasure''' (sometimes called the "right to be forgotten"): the right to ask an organization to delete personal data it holds about them.

That right is not unlimited. Article 17(3) lists situations where it does '''not''' apply. The one that matters for an archive like ours is '''Article 17(3)(d)''', which removes the erasure right to the extent that keeping the data is necessary:

That right is not unlimited. Article 17, paragraph 3 lists situations where it does '''not''' apply. The one that matters for an archive like ours is '''Article 17, paragraph 3(d)''', which removes the erasure right to the extent that keeping the data is necessary:

:''"for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) ... in so far as the [erasure right] is likely to render impossible or seriously impair the achievement of the objectives of that processing."''

:''"for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89, paragraph 1 ... in so far as the [erasure right] is likely to render impossible or seriously impair the achievement of the objectives of that processing."''

In plain terms: if deleting a name would break a genuine historical record that is kept for the public good, the law lets the record stand. '''Article 89(1)''' is the companion rule that requires such archives to be handled responsibly, keeping only what the record actually needs and nothing more.

In plain terms: if deleting a name would break a genuine historical record that is kept for the public good, the law lets the record stand. '''Article 89, paragraph 1''' is the companion rule that requires such archives to be handled responsibly, keeping only what the record actually needs and nothing more.

===Why this exemption exists===

Line 26:

Because much of the Honorverse fandom and TRMN's own framing is British, members sometimes ask whether the United Kingdom keeps the same exemption after leaving the EU. It does.

* The UK retained the GDPR as domestic law (the '''UK GDPR'''). '''Article 17(3)(d)''' survives in the same words, so the archiving and historical-research exemption to the right to erasure applies in the UK just as it does in the EU.

* The UK retained the GDPR as domestic law (the '''UK GDPR'''). '''Article 17, paragraph 3(d)''' survives in the same words, so the archiving and historical-research exemption to the right to erasure applies in the UK just as it does in the EU.

* The '''Data Protection Act 2018, section 19''' sets the UK safeguards for this kind of processing (the Article 89 conditions). Importantly, section 19 says the exemption is '''not''' available where the processing is likely to cause '''substantial damage or substantial distress''' to a person, or where it is used to make measures or decisions about a particular individual. An archive of historical orders does neither.

* The '''Data Protection Act 2018, Schedule 2, paragraph 28''' separately sets aside several other data-subject rights (such as access, rectification, restriction, portability, and objection) for personal data processed for archiving in the public interest.

Line 32:

So under both the EU and UK regimes, a faithful public-interest archive may retain names that appear in its official records, subject to handling the data responsibly and never in a way that harms the individual.

==Other jurisdictions==

==Other jurisdictions and non-profit status==

TRMN's membership is international, so members ~~sometimes~~ ask how privacy laws outside the EU and UK apply. Two ~~themes hold across~~ the major regimes~~: none of them~~ grants a "delete everything" right as broad as the GDPR's, and each ~~recognizes~~ exceptions ~~for free expression, the press~~, ~~research~~, or ~~record~~-~~keeping that support keeping~~ a truthful historical record~~. In addition, most of these laws only bind organizations above a size or activity threshold that a volunteer fan association typically does not meet~~. The summaries below are general and not legal advice.

TRMN's membership is international, so members ask how privacy laws outside the EU and UK apply. Two facts shape the answer. First, TRMN is a '''United States non-profit''', tax-exempt as a social and recreational club under Internal Revenue Code section 501(c)(7); it is a volunteer hobby organization, not a commercial business. Second, none of the major non-EU regimes grants a "delete everything" right as broad as the GDPR's, and each contains exceptions, thresholds, or scope limits that commonly place a small non-profit outside their reach or preserve a truthful historical record. The summaries below are general and not legal advice.

===United States (California and other states)===

California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105)~~. That right is~~ subject to ~~statutory~~ exceptions, ~~including one that preserves~~ the business's or ~~another person~~'s '''right of ~~free speech~~''', and ~~one for~~ '''~~research~~ in the ~~public interest~~''' ~~where deletion would seriously impair~~ the ~~research. The law also applies~~ only ~~to "businesses"~~ that ~~meet~~ revenue or data-~~volume thresholds~~, ~~which a nonprofit hobby organization generally~~ does not. ~~Several other US states have adopted similar consumer-privacy~~ laws~~, each with comparable deletion exceptions~~. ~~Separately, information drawn from~~ '''~~public records~~''' ~~is often outside~~ the ~~definition~~ of ~~protected~~ personal ~~information altogether~~.

California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Information drawn from '''public records''' is also typically outside the law entirely.

California was first, but by 2026 roughly nineteen states have comprehensive consumer-privacy laws, and every one of them includes a right to delete: '''Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island''', alongside California. For TRMN, two features run through nearly all of them:

* '''Non-profit treatment.''' Most of these laws exempt non-profit organizations outright, just as California does. A few do reach non-profits, notably '''Colorado, Oregon, Delaware, New Jersey, and Minnesota''' (some only in narrow categories such as insurance-fraud groups). But even in those states the law only applies above high '''thresholds''': typically the personal data of '''100,000 residents of that state''' in a year, dropping to 25,000 only for an organization that earns a quarter or more of its revenue from '''selling''' personal data. "Consumers" here means residents of the single state in question, so TRMN's members in any one state are a small fraction of its several-thousand worldwide membership, well under 100,000. TRMN also does not sell personal data, so the lower threshold cannot apply. It therefore falls below the applicability thresholds of these laws.

* '''Deletion exceptions.''' Where any of them could apply, each carries the same kinds of exceptions California does, allowing personal data to be kept to comply with a legal obligation, to exercise or defend legal rights, for internal uses consistent with the context in which it was provided, and, in several, for public-interest or record-keeping purposes. A faithful historical archive fits comfortably within these.

===Canada (PIPEDA)===

Canada's Personal Information Protection and Electronic Documents Act does '''not''' provide a general right to erasure; it is ~~built on~~ consent and ~~accuracy, and the limited "~~correction~~" it allows~~ concerns inaccurate, ~~incomplete~~, or ~~out-~~of~~-date information. PIPEDA expressly~~ '''does not apply~~'''~~ to ~~personal~~ information ~~collected,~~ used~~, or disclosed~~ for '''journalistic, artistic, or literary purposes'''~~, and it governs "~~commercial ~~activity", so the~~ record-keeping ~~of a volunteer association may fall~~ outside ~~it entirely~~.

Canada's Personal Information Protection and Electronic Documents Act does '''not''' provide a general right to erasure; it is consent-based and its narrow correction right concerns inaccurate or outdated information. PIPEDA applies to organizations that collect, use, or disclose personal information '''in the course of commercial activity''', and it expressly does not apply to information used for '''journalistic, artistic, or literary purposes'''. A volunteer non-profit's non-commercial member record-keeping generally falls outside PIPEDA's scope.

===Australia (Privacy Act 1988)===

Australia's Privacy Act and the Australian Privacy Principles do '''not''' grant a general right to erasure. APP 11 asks ~~organizations to destroy~~ or de-~~identify personal information~~ once ~~it is~~ no longer needed, but with ~~exceptions~~ where ~~the information is contained~~ in a record the organization is required or authorized to keep. ~~Historically the~~ Act also '''exempted small businesses''' below ~~an annual-~~turnover threshold (~~long~~ set at A$3 million), ~~though that exemption is~~ being narrowed by reforms ~~now~~ underway. A small volunteer organization has generally sat outside the Act'~~s coverage~~.

Australia's Privacy Act and the Australian Privacy Principles do '''not''' grant a general right to erasure. APP 11 asks that personal information be destroyed or de-identified once no longer needed, but with an exception where it sits in a record the organization is required or authorized to keep. The Act has also long '''exempted small businesses and many non-profits''' below a turnover threshold (set at A$3 million), a carve-out now being narrowed by reforms underway. A small volunteer organization has generally sat outside the Act.

===A note on the EU and UK===

Unlike the laws above, the GDPR and UK GDPR do '''not''' exempt non-profits: they apply to any organization that processes personal data, TRMN included. Non-profit status is therefore not what protects the record here. That protection comes from the '''archiving and historical-research exemption''' described earlier (Article 17, paragraph 3(d), read with Article 89, paragraph 1; in the UK, Data Protection Act 2018, section 19), which lets a faithful public-interest archive keep the names its official records contain.

==Children's personal data is always redacted==

Line 65:

Line 72:

* [https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/6/crossheading/archiving-in-the-public-interest Data Protection Act 2018, Schedule 2, Part 6 (Archiving in the public interest)], legislation.gov.uk

* [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105&lawCode=CIV California Civil Code section 1798.105 (Right to delete, CCPA/CPRA)], California Legislative Information

* [https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ US State Privacy Legislation Tracker], International Association of Privacy Professionals (IAPP)

* [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/ The Personal Information Protection and Electronic Documents Act (PIPEDA)], Office of the Privacy Commissioner of Canada

* [https://www.oaic.gov.au/privacy/australian-privacy-principles Australian Privacy Principles], Office of the Australian Information Commissioner

[[Category:~~Policy~~]]

[[Category:Policies]]

[[Category:~~TenthFleet~~]]

[[Category:Tenth Fleet]]

@@ Line 10: / Line 10: @@
 ==The right to erasure, and why it is not absolute==
-Under Article 17(1) of the GDPR, a person generally has the '''right to erasure''' (sometimes called the "right to be forgotten"): the right to ask an organization to delete personal data it holds about them.
+Under Article 17, paragraph 1 of the GDPR, a person generally has the '''right to erasure''' (sometimes called the "right to be forgotten"): the right to ask an organization to delete personal data it holds about them.
-That right is not unlimited. Article 17(3) lists situations where it does '''not''' apply. The one that matters for an archive like ours is '''Article 17(3)(d)''', which removes the erasure right to the extent that keeping the data is necessary:
+That right is not unlimited. Article 17, paragraph 3 lists situations where it does '''not''' apply. The one that matters for an archive like ours is '''Article 17, paragraph 3(d)''', which removes the erasure right to the extent that keeping the data is necessary:
-:''"for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) ... in so far as the [erasure right] is likely to render impossible or seriously impair the achievement of the objectives of that processing."''
+:''"for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89, paragraph 1 ... in so far as the [erasure right] is likely to render impossible or seriously impair the achievement of the objectives of that processing."''
-In plain terms: if deleting a name would break a genuine historical record that is kept for the public good, the law lets the record stand. '''Article 89(1)''' is the companion rule that requires such archives to be handled responsibly, keeping only what the record actually needs and nothing more.
+In plain terms: if deleting a name would break a genuine historical record that is kept for the public good, the law lets the record stand. '''Article 89, paragraph 1''' is the companion rule that requires such archives to be handled responsibly, keeping only what the record actually needs and nothing more.
 ===Why this exemption exists===
@@ Line 26: / Line 26: @@
 Because much of the Honorverse fandom and TRMN's own framing is British, members sometimes ask whether the United Kingdom keeps the same exemption after leaving the EU. It does.
-* The UK retained the GDPR as domestic law (the '''UK GDPR'''). '''Article 17(3)(d)''' survives in the same words, so the archiving and historical-research exemption to the right to erasure applies in the UK just as it does in the EU.
+* The UK retained the GDPR as domestic law (the '''UK GDPR'''). '''Article 17, paragraph 3(d)''' survives in the same words, so the archiving and historical-research exemption to the right to erasure applies in the UK just as it does in the EU.
 * The '''Data Protection Act 2018, section 19''' sets the UK safeguards for this kind of processing (the Article 89 conditions). Importantly, section 19 says the exemption is '''not''' available where the processing is likely to cause '''substantial damage or substantial distress''' to a person, or where it is used to make measures or decisions about a particular individual. An archive of historical orders does neither.
 * The '''Data Protection Act 2018, Schedule 2, paragraph 28''' separately sets aside several other data-subject rights (such as access, rectification, restriction, portability, and objection) for personal data processed for archiving in the public interest.
@@ Line 32: / Line 32: @@
 So under both the EU and UK regimes, a faithful public-interest archive may retain names that appear in its official records, subject to handling the data responsibly and never in a way that harms the individual.
-==Other jurisdictions==
+==Other jurisdictions and non-profit status==
-TRMN's membership is international, so members sometimes ask how privacy laws outside the EU and UK apply. Two themes hold across the major regimes: none of them grants a "delete everything" right as broad as the GDPR's, and each recognizes exceptions for free expression, the press, research, or record-keeping that support keeping a truthful historical record. In addition, most of these laws only bind organizations above a size or activity threshold that a volunteer fan association typically does not meet. The summaries below are general and not legal advice.
+TRMN's membership is international, so members ask how privacy laws outside the EU and UK apply. Two facts shape the answer. First, TRMN is a '''United States non-profit''', tax-exempt as a social and recreational club under Internal Revenue Code section 501(c)(7); it is a volunteer hobby organization, not a commercial business. Second, none of the major non-EU regimes grants a "delete everything" right as broad as the GDPR's, and each contains exceptions, thresholds, or scope limits that commonly place a small non-profit outside their reach or preserve a truthful historical record. The summaries below are general and not legal advice.
 ===United States (California and other states)===
-California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105). That right is subject to statutory exceptions, including one that preserves the business's or another person's '''right of free speech''', and one for '''research in the public interest''' where deletion would seriously impair the research. The law also applies only to "businesses" that meet revenue or data-volume thresholds, which a nonprofit hobby organization generally does not. Several other US states have adopted similar consumer-privacy laws, each with comparable deletion exceptions. Separately, information drawn from '''public records''' is often outside the definition of protected personal information altogether.
+California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Information drawn from '''public records''' is also typically outside the law entirely.
+California was first, but by 2026 roughly nineteen states have comprehensive consumer-privacy laws, and every one of them includes a right to delete: '''Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island''', alongside California. For TRMN, two features run through nearly all of them:
+* '''Non-profit treatment.''' Most of these laws exempt non-profit organizations outright, just as California does. A few do reach non-profits, notably '''Colorado, Oregon, Delaware, New Jersey, and Minnesota''' (some only in narrow categories such as insurance-fraud groups). But even in those states the law only applies above high '''thresholds''': typically the personal data of '''100,000 residents of that state''' in a year, dropping to 25,000 only for an organization that earns a quarter or more of its revenue from '''selling''' personal data. "Consumers" here means residents of the single state in question, so TRMN's members in any one state are a small fraction of its several-thousand worldwide membership, well under 100,000. TRMN also does not sell personal data, so the lower threshold cannot apply. It therefore falls below the applicability thresholds of these laws.
+* '''Deletion exceptions.''' Where any of them could apply, each carries the same kinds of exceptions California does, allowing personal data to be kept to comply with a legal obligation, to exercise or defend legal rights, for internal uses consistent with the context in which it was provided, and, in several, for public-interest or record-keeping purposes. A faithful historical archive fits comfortably within these.
 ===Canada (PIPEDA)===
-Canada's Personal Information Protection and Electronic Documents Act does '''not''' provide a general right to erasure; it is built on consent and accuracy, and the limited "correction" it allows concerns inaccurate, incomplete, or out-of-date information. PIPEDA expressly '''does not apply''' to personal information collected, used, or disclosed for '''journalistic, artistic, or literary purposes''', and it governs "commercial activity", so the record-keeping of a volunteer association may fall outside it entirely.
+Canada's Personal Information Protection and Electronic Documents Act does '''not''' provide a general right to erasure; it is consent-based and its narrow correction right concerns inaccurate or outdated information. PIPEDA applies to organizations that collect, use, or disclose personal information '''in the course of commercial activity''', and it expressly does not apply to information used for '''journalistic, artistic, or literary purposes'''. A volunteer non-profit's non-commercial member record-keeping generally falls outside PIPEDA's scope.
 ===Australia (Privacy Act 1988)===
-Australia's Privacy Act and the Australian Privacy Principles do '''not''' grant a general right to erasure. APP 11 asks organizations to destroy or de-identify personal information once it is no longer needed, but with exceptions where the information is contained in a record the organization is required or authorized to keep. Historically the Act also '''exempted small businesses''' below an annual-turnover threshold (long set at A$3 million), though that exemption is being narrowed by reforms now underway. A small volunteer organization has generally sat outside the Act's coverage.
+Australia's Privacy Act and the Australian Privacy Principles do '''not''' grant a general right to erasure. APP 11 asks that personal information be destroyed or de-identified once no longer needed, but with an exception where it sits in a record the organization is required or authorized to keep. The Act has also long '''exempted small businesses and many non-profits''' below a turnover threshold (set at A$3 million), a carve-out now being narrowed by reforms underway. A small volunteer organization has generally sat outside the Act.
+===A note on the EU and UK===
+Unlike the laws above, the GDPR and UK GDPR do '''not''' exempt non-profits: they apply to any organization that processes personal data, TRMN included. Non-profit status is therefore not what protects the record here. That protection comes from the '''archiving and historical-research exemption''' described earlier (Article 17, paragraph 3(d), read with Article 89, paragraph 1; in the UK, Data Protection Act 2018, section 19), which lets a faithful public-interest archive keep the names its official records contain.
 ==Children's personal data is always redacted==
@@ Line 65: / Line 72: @@
 * [https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/6/crossheading/archiving-in-the-public-interest Data Protection Act 2018, Schedule 2, Part 6 (Archiving in the public interest)], legislation.gov.uk
 * [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105&lawCode=CIV California Civil Code section 1798.105 (Right to delete, CCPA/CPRA)], California Legislative Information
+* [https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ US State Privacy Legislation Tracker], International Association of Privacy Professionals (IAPP)
 * [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/ The Personal Information Protection and Electronic Documents Act (PIPEDA)], Office of the Privacy Commissioner of Canada
 * [https://www.oaic.gov.au/privacy/australian-privacy-principles Australian Privacy Principles], Office of the Australian Information Commissioner
-[[Category:Policy]]
+[[Category:Policies]]
-[[Category:TenthFleet]]
+[[Category:Tenth Fleet]]

TenthFleet:GDPR: Difference between revisions

CMagnani (talk | contribs)