Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?
Under what circumstances would the GDPR apply to personal data that exists in physical form, such as information contained in notebooks or hard copy files?
Under the GDPR, the regulation applies to both automated and manual processing of personal data. For manual processing, the personal data must be part of a filing system or intended to be part of one. A filing system refers to any structured set of personal data that is accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.
From the book, European data protection law and practice, Eduardo Ustaran CIPP/E, 2nd Edition, page 87 - processing: According to Article 2, the following conditions must apply for the processing of personal data to be covered by the Regulation: (1) the processing must be wholly or partly carried out by automated means; or (2) where the processing is not by automated means, it must concern personal data that forms part of a filing system or is intended to form part of a filing system. A filing system refers to a structured set of personal data that is accessible according to specific criteria.
D. Only where the personal data is handled in a sufficiently structured manner so as to form part of a filing system. The GDPR applies to both automated and manual processing of personal data, but for manual processing, the personal data must be part of a filing system or intended to be part of one. A filing system is defined as any structured set of personal data that is accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.