Earlier quoted context omitted.
The problem is, everyone talks about the GDPR but they don't actually read it. If you read it, it's really clear: if you're not sending information to third parties then it's exceptionally easy to be compliant. A lot of things are "to best effort" which puts the burden of proof on the prosecution that you were grossly negligent. There is a dedicated website to explaining the regulation for dummies; https://gdpr.eu --…
It's hilarious that you think standards like "best effort" are clear. The lawyers in your company are loud about it because you have no way to know if you're in compliance or not. You're just hoping you are. The whole concept of compliance doesn't even exist because GDPR says nothing, so at any moment something that sounds reasonable can be considered no longer in compliance and there's no way to predict this. A stan…
The principles for satisfying “best efforts” standard have been enumerated as follows:
* "Best efforts" imposes a higher obligation than a legal "reasonable effort".
* "Best efforts" means taking, in good faith, all reasonable steps to achieve the objective, carrying the process to its logical conclusion and leaving no stone unturned. However, it does not require a party to sacrifice itself totally to the economic interests of the party to whom the duty is owed, although the interests of the other party must predominate.
* "Best efforts" includes doing everything known to be usual, necessary and proper for ensuring the success of the endeavour.
* The meaning of "best efforts" is, however, not boundless. It must be approached in the light of the particular contract, the parties to it and the contract's overall purpose as reflected in its language.
* While "best efforts" of the defendant must be subject to such overriding obligations as honesty and fair dealing, it is not necessary for the plaintiff to prove that the defendant acted in bad faith.
* Evidence of "inevitable failure" is relevant to the issue of causation of damage but not to the issue of liability. The onus to show that failure was inevitable regardless of whether the defendant made "best efforts" rests on the defendant.
* Evidence that the defendant, had it acted diligently, could have satisfied the "best efforts" test, is relevant evidence that the defendant did not use its best efforts.
Mere reasonable efforts will not suffice to meet the “best efforts” standard. Neither will occasional efforts made from time to time suffice. A higher level of effort is required.
Examples of situations where the standard was not met include:
* Contract for the purchase and sale of a house required the purchaser to obtain financing. Court found that the purchaser failed to do so because he applied for a loan for an inflated sum (by 60%), delayed the loan application, and that true reason for these actions was that the purchaser simply did not want to buy the property because he received a negative appraisal of it.
* Contract for the purchase and sale of land. The contract required the vendor use best efforts to obtain subdivision approvals. Obtaining approvals was also a condition precedent in the agreement, meaning that the parties could walk away from the transaction if the approvals were not obtained. The vendor hired an agent to obtain approvals, but the agent failed to advance the process. As time went on, the price of the land went up and the vendor notified the purchaser that it ought to be discharged from the obligation to close the transaction due to not receiving approvals. The Court found that the Vendors did not use best efforts. The court commented that to satisfy the standard, one must show progress, as well as reasonable and sensible response to roadblocks.
Examples of where the standard was met:
* An agreement to lease required tenants to obtain a business license to operate a car dealership on best-efforts basis. The tenants submitted an application within 3 days of signing the lease, did so accurately, but were told that the process would take significantly longer than anticipated. Best efforts standard was met.
Generally, there are more decisions where this standard is found to not have been not met than where it was met. Shy of impossibility, the best efforts standard imposes onerous obligations on the party that agrees to be bound by such a clause.
-----
The right to be forgotten does not apply to data that is not being processed, so your backup situation is clear too and if you ask then you get pretty clear answers. Obviously if you restore the backup you would be expected to re-process right to be forgotten requests, which can be stored for the duration of your backup.
Your lawyer has well and truly convinced you that it's difficult, it's not, and if you have a serious question; you can send it to your countries DPO office: https://edps.europa.eu/data-protection/data-protection/refer...
The backup question, for example, was clearly (publicly) answered by France's DPO.
To be clear here: I don't think you've actually interacted at all with the apparatus surrounding GDPR. It's not my lawyers who are loud, it's lawyer consultants- it's lawyers of companies who's business model is not compliant (trading personal data). It's people in the US and UK who are trying to spread as much uncertainty as possible to either make the EU look incompetent or non-competitive and/or weaken the bloc.
It's absurdly easy to be compliant. For all the whinging, if you're taking the necessary steps to secure data that you should have always been taking, and you don't sell peoples data, then the only thing you need to bake in is a "delete account" function- even things like legal records are exempt so transaction logs are not subject to GDPR. Just read the text.