Advice required

[Sylv3r]

Hi everyone,

 

Looking for some help with a GDPR issue…

 

One of my local schools has been in touch looking for some advice on a supplier who has proven to be a bit of a basketcase. The guy is a nightmare, especially as he is based over in Lapland.

 

Essentially: He maintains a list of all the children in the world who have been naughty or nice – I can’t seem to find the lawful basis for him to do this and they definitely haven’t all consented? Getting privacy notices to everyone using his preferred method is proving difficult too as a lot of them are catching alight in people’s chimneys! I am pretty sure he shares this list with his wife and some elves, worst thing is that it’s a physical copy and he takes it out and about with him (there’s no mobile working policy either).

 

He has no retention policy in place and I am not sure the information he collects is strictly necessary for his purposes (who needs to know if someone is naughty or nice to deliver a present?).

 

He has had subject access requests made, but he only works a few days each year so getting them back on time is impossible!

 

He didn’t do a Data Protection Impact Assessment before he started this present giving business – I don’t know how he managed to run it past his DPO, I certainly wouldn’t have green lit the project.

 

I am really struggling to give them good advice. Can anyone offer any solutions?

 

Thanks

 

Andrew

[siuko]

OMG LOL!!!

 

I still hadn't twigged when I got as far as the naughty or nice list and thought 'omg what is this person doing!!' lol

[elsiegee40]

I saw this online (facebook?) a couple of days ago. It's brilliant

[jdoyle]

The US have been tracking his nefarious activities for quite a while now. Their relationship with this guy is, to say the least, frosty.

 

Updates expected shortly on this issue.....

[clockend25]

I read far too much of that before twigging.

[GrumbleDook]

I don't get why people are worried about his retention policy. It is pretty obvious.

 

The naughty or nice list has to be kept for infinity. A risk adverse approach might say until the heat death of the universe, but until we have more understanding of the implications of magic on this, then it is hard to conduct a full PIA.

 

It needs to be that long, because some of the deliveries will be to those who believe in reincarnation and that may be needed to be taken into consideration, until there is a ruling to say that each incarnation is an individual data subject. I think we may need to consult with an expert on the matter ... I am sure the Dalai Lama has put in the required number of hours to be considered an expert in reincarnation.

 

We also have to consider that fact that just because someone doesn't believe in reincarnation, that doesn't stop reincarnation from believing in them.

 

So, retention period ... infinity. Discuss.

[Bedders]

who needs to know if someone is naughty or nice to deliver a present

 

Obviously this is a requirement. You wouldn't want someone who's made it onto his 'naughty' list to be rewarded, shirley?

[pubgrub277]

surely the rules on automated decision making and profiling come into play at some point. what are his provisions for appeals and review*?

*asking for a friend