T21 Data protection and security review

Conversation (turn by turn)

1. turn 1 · 0:06 · 0:06 Katarina Voss 2026-04-09

   I will be direct because I have thirty minutes. I am doing an annual review of processors and I have questions I have not had answered before.

2. turn 2 · 0:22 · 0:22 Marco Rossi 2026-04-09

   Go ahead.

3. turn 3 · 0:26 · 0:26 Katarina Voss 2026-04-09

   First, where does our data physically sit?

4. turn 4 · 0:30 · 0:30 Tomas Lindholm 2026-04-09

   Okay.

5. turn 5 · 0:33 · 0:33 Tomas Lindholm 2026-04-09 · cited by ers-hosting

   Your environment is hosted in the EU. West Europe region.

6. turn 6 · 0:39 · 0:39 Katarina Voss 2026-04-09

   Named in the agreement?

7. turn 7 · 0:46 · 0:46 Lena Fischer 2026-04-09

   Right.

8. turn 8 · 0:48 · 0:48 Tomas Lindholm 2026-04-09

   The region is named, yes.

9. turn 9 · 0:55 · 0:55 Katarina Voss 2026-04-09

   Second. Sub-processors. Our DPA has an annex listing four. Is that still...

10. turn 10 · 1:05 · 1:05 Lena Fischer 2026-04-09

    Mm-hm.

11. turn 11 · 1:08 · 1:08 Katarina Voss 2026-04-09

    four?

12. turn 12 · 1:15 · 1:15 Tomas Lindholm 2026-04-09

    I believe it is five now. There

13. turn 13 · 1:24 · 1:24 Marco Rossi 2026-04-09

    Yes.

14. turn 14 · 1:27 · 1:27 Tomas Lindholm 2026-04-09

    is a monitoring monitoring and observability provider that was on the...

15. turn 15 · 1:37 · 1:37 Marco Rossi 2026-04-09

    Yeah.

16. turn 16 · 1:41 · 1:41 Katarina Voss 2026-04-09

    Added when?

17. turn 17 · 1:48 · 1:48 Marco Rossi 2026-04-09

    Yeah.

18. turn 18 · 1:50 · 1:50 Tomas Lindholm 2026-04-09

    I would have to check the date.

19. turn 19 · 1:55 · 1:55 Marco Rossi 2026-04-09

    Mm, okay.

20. turn 20 · 1:58 · 1:58 Katarina Voss 2026-04-09

    Were we notified?

21. turn 21 · 2:04 · 2:04 Tomas Lindholm 2026-04-09

    I do not know.

22. turn 22 · 2:07 · 2:07 Katarina Voss 2026-04-09

    Then that is my first finding. Where is that provider?

23. turn 23 · 2:14 · 2:14 Tomas Lindholm 2026-04-09

    The company is European. I am not certain where all their processing happens and I would rather find out than guess in front of you.

24. turn 24 · 2:33 · 2:33 Priya Nair 2026-04-09

    Okay, yeah.

25. turn 25 · 2:34 · 2:34 Unidentified guest 2026-04-09

    so Please find out and put it in writing. If any of it...

26. turn 26 · 2:44 · 2:44 Katarina Voss 2026-04-09

    is.

27. turn 27 · 2:49 · 2:49 Marco Rossi 2026-04-09

    We will come back within a

28. turn 28 · 2:54 · 2:54 Tomas Lindholm 2026-04-09

    Yeah, yeah.

29. turn 29 · 2:58 · 2:58 Marco Rossi 2026-04-09

    week.

30. turn 30 · 3:03 · 3:03 Priya Nair 2026-04-09

    Mm.

31. turn 31 · 3:04 · 3:04 Katarina Voss 2026-04-09

    Third question, and this is the one I actually came for. Meeting recordings.

32. turn 32 · 3:17 · 3:17 Lena Fischer 2026-04-09

    Yeah.

33. turn 33 · 3:20 · 3:20 Lena Fischer 2026-04-09

    Ah.

34. turn 34 · 3:25 · 3:25 Unidentified guest 2026-04-09

    Yes.

35. turn 35 · 3:29 · 3:29 Unidentified guest 2026-04-09 · cited by ers-recordings

    actually Every meeting between our teams appears

36. turn 36 · 3:37 · 3:37 Katarina Voss 2026-04-09

    to be be recorded and transcribed. Who decided

37. turn 37 · 3:43 · 3:43 Lena Fischer 2026-04-09

    Okay.

38. turn 38 · 3:47 · 3:47 Katarina Voss 2026-04-09

    that?

39. turn 39 · 3:53 · 3:53 Lena Fischer 2026-04-09 · cited by ers-recordings

    Nobody decided. It is on by default.

40. turn 40 · 4:00 · 4:00 Priya Nair 2026-04-09

    Okay.

41. turn 41 · 4:03 · 4:03 Katarina Voss 2026-04-09

    On whose tenant?

42. turn 42 · 4:10 · 4:10 Marco Rossi 2026-04-09

    Right.

43. turn 43 · 4:11 · 4:11 Priya Nair 2026-04-09

    like Both, depending on who organises.

44. turn 44 · 4:17 · 4:17 Lena Fischer 2026-04-09

    Right.

45. turn 45 · 4:19 · 4:19 Katarina Voss 2026-04-09

    So, so there are transcripts of our staff on your systems and transcripts of your staff on ours, going back how far?

46. turn 46 · 4:30 · 4:30 Marco Rossi 2026-04-09

    Two years, in our case. Since the first pre-sales call.

47. turn 47 · 4:41 · 4:41 Lena Fischer 2026-04-09

    Yeah.

48. turn 48 · 4:45 · 4:45 Katarina Voss 2026-04-09

    What is the retention, period?

49. turn 49 · 4:54 · 4:54 Marco Rossi 2026-04-09

    I do not think there is one.

50. turn 50 · 5:00 · 5:00 Tomas Lindholm 2026-04-09

    Yeah.

51. turn 51 · 5:04 · 5:04 Unidentified guest 2026-04-09

    like There is always one. Either,

52. turn 52 · 5:07 · 5:07 Marco Rossi 2026-04-09

    Exactly.

53. turn 53 · 5:08 · 5:08 Katarina Voss 2026-04-09

    you have set it or you are keeping it

54. turn 54 · 5:16 · 5:16 Tomas Lindholm 2026-04-09

    Yes.

55. turn 55 · 5:19 · 5:19 Katarina Voss 2026-04-09

    indefinitely, which is a decision you have made by not making

56. turn 56 · 5:28 · 5:28 Priya Nair 2026-04-09

    Sure.

57. turn 57 · 5:32 · 5:32 Katarina Voss 2026-04-09

    it.

58. turn 58 · 5:36 · 5:36 Priya Nair 2026-04-09

    Okay, yeah.

59. turn 59 · 5:40 · 5:40 Marco Rossi 2026-04-09 · cited by ers-recordings

    So, then we are keeping it indefinitely.

60. turn 60 · 5:46 · 5:46 Katarina Voss 2026-04-09

    Yeah.

61. turn 61 · 5:48 · 5:48 Katarina Voss 2026-04-09

    Yeah so, what that is the...

62. turn 62 · 5:51 · 5:51 Lena Fischer 2026-04-09

    Everything. Whatever anyone said.

63. turn 63 · 5:55 · 5:55 Katarina Voss 2026-04-09

    Yep.

64. turn 64 · 5:59 · 5:59 Katarina Voss 2026-04-09

    Give me an example of something in there that so...

65. turn 65 · 6:05 · 6:05 Priya Nair 2026-04-09

    One of my team explained on if the... needed to move a so...

66. turn 66 · 6:21 · 6:21 Marco Rossi 2026-04-09

    Yeah.

67. turn 67 · 6:25 · 6:25 Priya Nair 2026-04-09

    was a family court date. That is in a transcript somewhere.

68. turn 68 · 6:32 · 6:32 Katarina Voss 2026-04-09

    kind of like Whose?

69. turn 69 · 6:37 · 6:37 Marco Rossi 2026-04-09

    Yeah.

70. turn 70 · 6:41 · 6:41 Priya Nair 2026-04-09 · cited by ers-elin

    Elin Bergqvist. She is

71. turn 71 · 6:47 · 6:47 Tomas Lindholm 2026-04-09

    Yeah.

72. turn 72 · 6:48 · 6:48 Priya Nair 2026-04-09

    my integration team. It was the workshop on the eleventh September, sort of so it is in that recording.

73. turn 73 · 7:06 · 7:06 Katarina Voss 2026-04-09

    And she does not know it...

74. turn 74 · 7:12 · 7:12 Unidentified guest 2026-04-09

    is there.

75. turn 75 · 7:17 · 7:17 Priya Nair 2026-04-09

    Yes.

76. turn 76 · 7:21 · 7:21 Priya Nair 2026-04-09 · cited by ers-elin

    She does not know it exists.

77. turn 77 · 7:27 · 7:27 Katarina Voss 2026-04-09

    Hmm. Yes. That is the kind of thing.

78. turn 78 · 7:35 · 7:35 Marco Rossi 2026-04-09

    We also had a request in November from one of your colleagues to remove a health reference from our notes.

79. turn 79 · 7:52 · 7:52 Katarina Voss 2026-04-09

    Yeah.

80. turn 80 · 7:53 · 7:53 Unidentified guest 2026-04-09

    Was it removed?

81. turn 81 · 8:00 · 8:00 Marco Rossi 2026-04-09

    From the notes we knew about. I committed to finding the others...

82. turn 82 · 8:06 · 8:06 Katarina Voss 2026-04-09

    True.

83. turn 83 · 8:08 · 8:08 Marco Rossi 2026-04-09

    and I have not closed

84. turn 84 · 8:15 · 8:15 Katarina Voss 2026-04-09

    So a data subject made an erasure request in November and... Sorry, what? it is April.

85. turn 85 · 8:29 · 8:29 Marco Rossi 2026-04-09

    Okay so, yes.

86. turn 86 · 8:34 · 8:34 Katarina Voss 2026-04-09

    Okay, yeah.

87. turn 87 · 8:38 · 8:38 Katarina Voss 2026-04-09

    I appreciate you telling me rather for the... I will send you the four actions in writing this afternoon so there

88. turn 88 · 8:56 · 8:56 Lena Fischer 2026-04-09

    Okay, yeah.

89. turn 89 · 8:59 · 8:59 Katarina Voss 2026-04-09

    is no ambiguity about what I asked for.

90. turn 90 · 9:04 · 9:04 Marco Rossi 2026-04-09

    Okay so, basically Please do.

91. turn 91 · 9:07 · 9:07 Tomas Lindholm 2026-04-09

    Yeah.

92. turn 92 · 9:08 · 9:08 Marco Rossi 2026-04-09

    It would have been worse to have you find it.

93. turn 93 · 9:13 · 9:13 Lena Fischer 2026-04-09

    Yeah.

94. turn 94 · 9:16 · 9:16 Katarina Voss 2026-04-09

    It would. Here is what I want. A retention period, stated.

95. turn 95 · 9:24 · 9:24 Tomas Lindholm 2026-04-09

    Yeah.

96. turn 96 · 9:25 · 9:25 Katarina Voss 2026-04-09

    A written answer on the fifth sub-processor. Confirmation that the November request request is fully closed, with a list

97. turn 97 · 9:41 · 9:41 Tomas Lindholm 2026-04-09

    Okay.

98. turn 98 · 9:43 · 9:43 Katarina Voss 2026-04-09

    of where the data was. And going forward, a position on what happens but the...

99. turn 99 · 9:55 · 9:55 Unidentified guest 2026-04-09

    So...

100. turn 100 · 9:57 · 9:57 Katarina Voss 2026-04-09

     at the

101. turn 101 · 10:01 · 10:01 Tomas Lindholm 2026-04-09

     1 second Mm, okay.

102. turn 102 · 10:05 · 10:05 Katarina Voss 2026-04-09

     moment the position is that we...

103. turn 103 · 10:12 · 10:12 Priya Nair 2026-04-09

     Right.

104. turn 104 · 10:16 · 10:16 Katarina Voss 2026-04-09

     accumulate everything and hope.

105. turn 105 · 10:23 · 10:23 Priya Nair 2026-04-09

     Sure.

106. turn 106 · 10:25 · 10:25 Tomas Lindholm 2026-04-09

     That is a,

107. turn 107 · 10:28 · 10:28 Priya Nair 2026-04-09

     Mm, okay.

108. turn 108 · 10:29 · 10:29 Tomas Lindholm 2026-04-09

     fair summary of the position.

109. turn 109 · 10:36 · 10:36 Priya Nair 2026-04-09

     Okay.

110. turn 110 · 10:37 · 10:37 Katarina Voss 2026-04-09

     One more thing. I have seen a document that describes one... of your own people as, I mean and I am paraphrasing, the person whose judgement determines whether the project succeeds.

111. turn 111 · 11:03 · 11:03 Marco Rossi 2026-04-09

     Well, right...

112. turn 112 · 11:10 · 11:10 Lena Fischer 2026-04-09

     Yeah.

113. turn 113 · 11:13 · 11:13 Marco Rossi 2026-04-09

     That would, be about one of your people, not ours.

114. turn 114 · 11:26 · 11:26 Tomas Lindholm 2026-04-09

     Okay.

115. turn 115 · 11:27 · 11:27 Unidentified guest 2026-04-09

     It does not name her.

116. turn 116 · 11:34 · 11:34 Marco Rossi 2026-04-09

     No.

117. turn 117 · 11:37 · 11:37 Katarina Voss 2026-04-09

     you know It says the fresh category

118. turn 118 · 11:42 · 11:42 Tomas Lindholm 2026-04-09

     Yeah.

119. turn 119 · 11:46 · 11:46 Unidentified guest 2026-04-09

     manager with sole knowledge of the categories.

120. turn 120 · 11:53 · 11:53 Katarina Voss 2026-04-09 · cited by ers-description-identifies

     We have one of those. So it names her perfectly well without using her name,

121. turn 121 · 12:05 · 12:05 Tomas Lindholm 2026-04-09

     Sure.

122. turn 122 · 12:09 · 12:09 Katarina Voss 2026-04-09

     and it is an assessment of an individual's competence held by a third party, which she has never seen.

123. turn 123 · 12:22 · 12:22 Marco Rossi 2026-04-09

     Yes.

124. turn 124 · 12:23 · 12:23 Marco Rossi 2026-04-09

     That is correct and I had not thought about it that way.

125. turn 125 · 12:30 · 12:30 Priya Nair 2026-04-09

     Right.

126. turn 126 · 12:33 · 12:33 Katarina Voss 2026-04-09 · cited by ers-description-identifies

     Most people have not. Removing a name is not anonymisation if one person fits the description.

127. turn 127 · 12:45 · 12:45 Lena Fischer 2026-04-09

     Katarina, is this going to stop the project.

128. turn 128 · 12:53 · 12:53 Marco Rossi 2026-04-09

     Yes.

129. turn 129 · 12:55 · 12:55 Unidentified guest 2026-04-09

     No. It is going to generate four actions and some discomfort, which is my job.

130. turn 130 · 13:06 · 13:06 Tomas Lindholm 2026-04-09

     Understood.

131. turn 131 · 13:12 · 13:12 Katarina Voss 2026-04-09

     There is a fifth thing and I am not going to make it an action, because I cannot work out who it would be for.

132. turn 132 · 13:26 · 13:26 Marco Rossi 2026-04-09

     Go on.

133. turn 133 · 13:29 · 13:29 Katarina Voss 2026-04-09

     We have agreed a retention period. Twelve months on the recordings. I have been trying to find where that actually happens and I cannot find anywhere that it does.

134. turn 134 · 13:49 · 13:49 Priya Nair 2026-04-09

     It is four different teams writing into the same place.

135. turn 135 · 13:55 · 13:55 Unidentified guest 2026-04-09

     Yes. And they each write a different shape, so there is no one record I can attach the rule to. If they all looked the same I could put a date on it and be finished.

136. turn 136 · 14:15 · 14:15 Tomas Lindholm 2026-04-09

     Could we change the shape?

137. turn 137 · 14:19 · 14:19 Unidentified guest 2026-04-09

     The one that went first cannot carry a date at all. It was never designed to. And everything since has copied it.

138. turn 138 · 14:34 · 14:34 Lena Fischer 2026-04-09

     So we have a commitment and no way to keep it.

139. turn 139 · 14:40 · 14:40 Unidentified guest 2026-04-09

     We have a commitment and nobody whose job it is. Those are different problems and I would like the second one solved first.

140. turn 140 · 14:55 · 14:55 Marco Rossi 2026-04-09

     Mm.