GDPR: Local encrypted database of non-identifiable information
<p>There is a piece of software that has a database on my local computer. This database does not contain personally identifiable information but the contents are created by the user. However, this database is encrypted and the software company in question does not want anyone else to open this database.
There is no other way to retrieve data out of this database other than using the software provided by the company (which provides no way to export the data in bulk).</p>

<p>My question is regarding the GDPR. Does this company have to provide a method to exercise your right to obtain a copy of your data? <a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">Article 15.3</a> says that it should however this might only be concerning personally identifiable data. That part is unclear to me.
<a href="https://gdpr-info.eu/art-12-gdpr/" rel="nofollow noreferrer">Article 12.1</a> says that the company should provide this data in a <code>concise, transparent, intelligible and easily accessible form</code>. A database (encrypted or not) does not comply with this.</p>

<p>Does this database of non-identifiable data apply to these GDPR articles? Or any other relevant articles?</p>

<p>If the data isn't personal data as defined under Article 4 then the GDPR's right of access doesn't apply to it.</p>

<p>Article 15.3 says (my emphasis) "The controller shall provide a copy of the <em>personal data</em> undergoing processing. ..."</p>

<p>It has a footnote or cite to Recital 63, which says (my emphasis): "A data subject should have the right of access to <em>personal data</em> which have been collected concerning him or her ..."</p>

<p>The GDPR is about "the protection of natural persons with regard to the processing of personal data..."</p>

<p>Without knowing more about the database in question, we couldn't say whether it does in fact hold personal data or what other rules may be relevant.</p>

<p>I am doubtful that the GDPR applies here. The software vendor would have to be a <em>data controller</em> for data subject rights to apply. This is only the case when they control the purposes and means of processing for some personal data. However, they do not seem to control the purposes for which the data in this database is collected – you control the content yourself. This would e.g. be different if they collected usage data in the background.</p>

<p>Even assuming the GDPR did apply, your right to Access has been satisfied since you can use the application to inspect the database contents. The Access right does not imply a bulk export. For that, we would have to look at the Art 20 right to Data Portability. But since your database is stored locally, I don't think you have provided any data to the controller. That right is also linked to certain legal bases of processing. Also, the database file itself possibly satisfies the requirements of the article: while it's not a commonly-used interoperable format, it <em>is</em> machine-readable<sup>[1]</sup>. Per Recital 68, the right to Data Portability “should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible.”</p>

<p><sup>[1]: This possibly depends on what you mean with “encrypted”. Binary formats are machine-readable. Encrypted files are machine-readable if you hold the key.</sup></p>

gdpr