GDPR & European Law - Deleting Archived Lists

[Deleted user]

Hi,

I have a client which manages medical patients data. These archived lists must be able to be deleted, not just archived as they include sensitive data that the law requires us to delete. Not having that ability is a direct violation of the law and makes Trello impossible to be used in a medical center, hospital or any other health related institution that manages patient data and this is true for every EU country out there.

Browsing the "community" forum here I see tons of people complaints against the fact that they cannot delete their own data after archiving these lists. Why?

Why is not Atlassian understanding that the European Union is a regulated market where the rules and laws are above private companies and if they want to offer their services here, they should follow the law? I think to send that to some European Commission representatives so they could maybe force Atlassian to comply with the law just like they did with Microsoft, Facebook, Google and others.

[Iain Dooley]

@[deleted] yeah it's a little strange, you can't even delete lists through the API.

The simplest way to permanently delete a list is to move the list to a different board and then delete that board.

You could do this periodically for a client, for example have a board called "client name ARCHIVE" and then delete that board which will permanently remove all data for that board, including all lists and cards.

You could also automate this using the API, for example here it is with Trellinator:

https://gist.github.com/iaindooley/925c2cd65ad11931c2428bf0386d523e

You can see how to install Trellinator here:

https://community.atlassian.com/t5/Marketplace-Apps-articles/Introducing-Trellinator-Automate-Trello-with-Google-Apps-Script/ba-p/925271

Doing this would have the added benefit that if you accidentally archived a list you would have some time to undo that action by finding it in the other board.

[Deleted user]

Why is that process so complicated? Why isn't that built-in? I do understand about people having to confirm twice for not doing accidental deletions, but once archived why you cannot delete lists just like boards?

[Iain Dooley]

@[deleted] I have no idea but since there is a way to do it I don't think you could argue that it's non compliant 

[Deleted user]

Yeah but there is also things in regards to weather or not these things we’re made difficult on their own for a purpose.

Microsoft was fined in the EU for providing IE by default despite the fact that a user can download another one on their own.

One should not assume that each customer can be a geek, a developer, a coder and could setup an API. Quite the opposite. The majority of the visitors would have no clue how to do that. I don’t think anything difficult for the owners of Trello to add the functionality of deleting lists.

[Iain Dooley]

@[deleted] You don't have to do it with the API, you can move a list to another board then delete the board in the interface. This isn't the same as an anti-trust case where Microsoft is exploiting their market dominance in one area to build a monopoly in another, it's more like an interface inconvenience.

You could say it's even a feature: we make it harder to delete lists because it can be so catastrophic, but any user can do it by simply moving that list to another board and deleting it. You can also delete individual cards in a list, without deleting a list: lists inherently don't hold any data at all that might be considered "personal information".

I'm not even a lawyer and I reckon I could argue this one in a court of law pretty easily ;)

[Deleted user]

I am not saying it's a market manipulation, it's related to data management. You can't even imagine what kind of crazy checks we have for that at the moment. They ask for procedures and everything.

I do get the idea that you made lists to be deleted harder, but when you have the cards themselves already deleted, then these lists contain just titles - names in that example, so it doesn't make sense for them not to be deleted as well, in fact cards would be the more catastrophic thing to delete.