How to handle my manager asking me to do something possibly unethical? [closed]

Question

I was asked to implement a new feature in a piece of our software for users to be able to schedule themselves for deletion (we auto-remove expired users with an automated overnight process). If a user wants to be deleted, they can click a button in their profile screen to be deleted within the next 24 hours (in the next batch).

My manager wants me to implement an "export" feature into the automated process so we can export users into our other system before they have been deleted, where they can be anonymised in there for reporting since some of our customers need to be able to report user's religions to be legally compliant in Ireland - not the user's details, just a total count of protestant vs catholic users.

He advises me that we are allowed to export their data (thus keeping their data in our other system) and still be GDPR compliant. I worry that this will actually make us non-compliant since I don't feel that data needs to be added to the report or leave the system in the first place. I fear it is unethical to implement such a feature.

What can I do in this situation without putting my job security on the line? Am I allowed to refuse to do this work because I feel it is unethical or potentially illegal? If so, what precautions can I take?

EDIT: I live in the UK. Our customer is Irish

Answer 1

The important phrase you mentioned is:

they can be anonymised

According to the GDPR :

The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

Source

As long as the data is not personally identifiable, it is compliant with GDPR.

Answer 2

You are allowed to discuss this matter with your manager's superior. I don't know that much about GDPR, but it seems obvious that people who wish to get removed from your system want to get removed from your system, so what you are asked to do might be an intentional GDPR violation, and might end up costing your company real money. That decision may very well be above the manager's paygrade.

Answer 3

First things first are you a native of Northern Ireland ? I assume not.

As background NI has some very odd differences to UK law its illegal to wear football colours at work or to display team emblems. The reason is obvious when you consider the sectarian aspects of football.

There are also very strict rules of fair treatment of Catholics and Protestants break those and there will be a political ruckus and may annoy those in the “communities” with connections to paramilitary organisations.

I would

First Double check with your boss an ideally with your legal department and get it in writing.

If it’s a question of bending the rules of GDPR vs breaking the spirt of NI law I would obey NI law which I would suspect override GDPR though if its required in NI to conform to the spirit of NI law I suspect it would be ok under GPDR.