GDPR, transaction memo and a disgruntled ex-employee...

[ThomasTheTGV]

Not sure if this belongs here in regulation corner bit here a thought experiment about the General Data Protection Regulation (GDPR):

Imagine that an employer in the Netherlands uses the Ripple Ledger for sending/escrowing funds for his employees. His administrator uses the transaction memo fields to ID the transactions to the different employees by using their e-mail addresses ( john.doe@company.nl) and the company ID number (which is tied to the dutch BIG-register) for this person.

One of the employees leaves the company and decides he no longer wants to be affiliated with the company in any way... He (it's a he this time) invokes the right to be forgotten by the company. So the administrator processes the request and (after the legal compliant waiting period) deletes all data in the company administration... Except for the payments done on the Ripple Ledger he can't mutate those, although he is legally compliant to do so.

Now for my questions:

• At the moment it is not possible for the company administrator to mutate or delete these entries, where should he report this issue?
• The disgruntled ex-employee gets tired of waiting and asks Ripple to remove/mutate the transactions, can Ripple do this?
• After a few months the disgruntled ex-employee gets tired of it all decides to take legal action... Should he sue the company? Or could he sue Ripple as well?

What do you guys think?

And for the bonus.... Replace Ripple ledger by the Bitcoin ledger

 

Edited May 22, 2018 by ThomasTheTGV
addes examples for the email and ID

[Guest]

It’s no different than a law that decrees the tides not to come in.  

A non-starter because it is not possible.  Might as well say that all involved must also forget it happened.  Can’t be done.  

[CryptoJym]

If the company deletes all data of the employee's record at their HQ, they wouldn't have anything on hand that could be used to link the employee to those entries on the ledger correct? 

[Graine]

Unless he can prove that whatever hashed id is connected to his personality, I don't see why any legal repercussions could arise. 

Also, highly unlikely that a company would use RCL and pay tx fees instead of a simple database. 

[XRP-JAG]

GDPR is personal information only.

You don't have to delete all their work when somebody leaves! 

[ThomasTheTGV]

17 minutes ago, Tinyaccount said:

It’s no different than a law that decrees the tides not to come in.  

A non-starter because it is not possible.  Might as well say that all involved must also forget it happened.  Can’t be done.  

Why not? The disgruntled ex-employee doesn't mind the transactions.... He does mind the e-mail address (which has his name in it) and the company ID if these could removed everything would be fine. He has the right by law (GDPR) to be forgotten, fines can be very high if the company doesn't comply!

I understand that the company/administrator should have never used this information in the transaction.... But for the sake of the argument they did.

[ThomasTheTGV]

18 minutes ago, XRP-JAG said:

GDPR is personal information only.

You don't have to delete all their work when somebody leaves! 

E-mail address can be tied to a person john.doe@company.nl and so does an ID (like the dutch BIG-register) in some cases.

Edited May 22, 2018 by ThomasTheTGV

[ThomasTheTGV]

28 minutes ago, CryptoJym said:

If the company deletes all data of the employee's record at their HQ, they wouldn't have anything on hand that could be used to link the employee to those entries on the ledger correct? 

I'm playing devils advocate here: E-mail address can be tied to a person john.doe@company.nl and so does an ID (like the dutch BIG-register) in some cases.

Edited May 22, 2018 by ThomasTheTGV

[Trickery]

A history of payments to employees would probably be exempted from the law because of tax recording requirements.

[ThomasTheTGV]

2 minutes ago, Trickery said:

A history of payments to employees would probably be exempted from the law because of tax recording requirements.

Agree BUT the memo fields aren't necessary for the transaction.

[Trickery]

1 minute ago, ThomasTheTGV said:

Agree BUT the memo fields aren't necessary for the transaction.

True, but the transaction still needs to be traceable to an individual.

[ThomasTheTGV]

26 minutes ago, Graine said:

Unless he can prove that whatever hashed id is connected to his personality, I don't see why any legal repercussions could arise. 

Also, highly unlikely that a company would use RCL and pay tx fees instead of a simple database. 

Valid point but I needed an example where a company f-ed up. 

[ThomasTheTGV]

2 minutes ago, Trickery said:

True, but the transaction still needs to be traceable to an individual.

I'm playing devils advocate here and added E-mail address which can be tied to a person john.doe@company.nl and ID (like the dutch BIG-register) in this case.

[PG1]

So in your scenario the employer is choosing to store personal info on a public ledger? Seems problematic way before an employee becomes disgruntled.

[Graine]

41 minutes ago, ThomasTheTGV said:

Why not? The disgruntled ex-employee doesn't mind the transactions.... He does mind the e-mail address (which has his name in it) and the company ID if these could removed everything would be fine. He has the right by law (GDPR) to be forgotten, fines can be very high if the company doesn't comply!

I understand that the company/administrator should have never used this information in the transaction.... But for the sake of the argument they did.

Storing personal information unhashed on the internet is very unwise. If they did indeed input personal information on a blockchain - then perhaps they deserve to pay the price. 

As per your other question - the only way to remove those is to purge the ledgers that contain those transactions. You technically could force Ripple to comply. But will have to hunt any other entities with full history on your own.