Re: Spreadsheets
Storing the data in a spreadsheet is perfectly acceptable. The GDPR does not specify the medium nor mechanism of storage nor means of securing the data, just specifying principles.
Storing the data in a spreadsheet and allowing some numpty free access to it when it includes sensitive personal data (a special category) is utterly wrong. Fine if access to the spreadsheet was highly restricted but when it's been sent unencrypted in an email it's plainly obvious that this is almost certainly not the case.
It's probably stored in an unencrypted form on a cloud service with cloud copies hosted in datacentres where the regime has effectively zero data protection for individuals.
Biting the hand that feeds IT
