GDPR & European Law - Deleting Archived Lists

Question

Hi,

I have a client which manages medical patients data. These archived lists must be able to be deleted, not just archived as they include sensitive data that the law requires us to delete. Not having that ability is a direct violation of the law and makes Trello impossible to be used in a medical center, hospital or any other health related institution that manages patient data and this is true for every EU country out there.

Browsing the "community" forum here I see tons of people complaints against the fact that they cannot delete their own data after archiving these lists. Why?

Why is not Atlassian understanding that the European Union is a regulated market where the rules and laws are above private companies and if they want to offer their services here, they should follow the law? I think to send that to some European Commission representatives so they could maybe force Atlassian to comply with the law just like they did with Microsoft, Facebook, Google and others.

unknown · Answer

I am not saying it's a market manipulation, it's related to data management. You can't even imagine what kind of crazy checks we have for that at the moment. They ask for procedures and everything.

I do get the idea that you made lists to be deleted harder, but when you have the cards themselves already deleted, then these lists contain just titles - names in that example, so it doesn't make sense for them not to be deleted as well, in fact cards would be the more catastrophic thing to delete.

Iain Dooley · Answer

@[deleted]You don't have to do it with the API, you can move a list to another board then delete the board in the interface. This isn't the same as an anti-trust case where Microsoft is exploiting their market dominance in one area to build a monopoly in another, it's more like an interface inconvenience.

You could say it's even a feature: we make it harder to delete lists because it can be so catastrophic, but any user can do it by simply moving that list to another board and deleting it. You can also delete individual cards in a list, without deleting a list: lists inherently don't hold any data at all that might be considered "personal information".

I'm not even a lawyer and I reckon I could argue this one in a court of law pretty easily ;)

unknown · Answer

Yeah but there is also things in regards to weather or not these things we’re made difficult on their own for a purpose.

Microsoft was fined in the EU for providing IE by default despite the fact that a user can download another one on their own.

One should not assume that each customer can be a geek, a developer, a coder and could setup an API. Quite the opposite. The majority of the visitors would have no clue how to do that. I don’t think anything difficult for the owners of Trello to add the functionality of deleting lists.