kenbaylor

If it's not exposed to the internet no problem. Not true unfortunately under the GDPR nor it's predecessor, if the notes are publicly available:

Bodil Lindquist v Åklagarkammaren (2003) Mrs. Lindquist (whose purposes were mostly charitable and religious) published on a private home page personal data about her colleagues, including telephone numbers and information about a coworker’s injured foot and medical leave. This case raised the question if a private home page accessible to only those who have the address is permitted under one of the exclusions (household activity). The European Court of Justice ruled that it is not.

Not true unfortunately under the GDPR nor it's predecessor, if the notes are publicly available:

Bodil Lindquist v Åklagarkammaren (2003) Mrs. Lindquist (whose purposes were mostly charitable and religious) published on a private home page personal data about her colleagues, including telephone numbers and information about a coworker’s injured foot and medical leave. This case raised the question if a private home page accessible to only those who have the address is permitted under one of the exclusions (household activity). The European Court of Justice ruled that it is not.

Major privacy honeypot...enter your number, have it PRINTED ON THE WEBPAGE for millions of other visitors to see, add to spam lists etc, they could at least mask the number....

You are correct, and they will likely change that or face heavy fines, now that they have lost this case.

GDPR will have a massive effect no matter where you are. The trickle-down affects are key.

Many large companies do business with Europe. Many of them are implementing GDPR-like controls and/or adopting Privacy Shield. Other US companies doing business with them must adhere to the new vendor controls these US-companies have adopted, or lose that business.

Across the world, (e.g. Singapore, Philippines and Japan) Privacy laws are being re-written to align parts of local law to GDPR.

The US has limited privacy laws generally (e.g. dat breach notification laws in CA and MA), but has adopted specific protections depending on industry (HIPAA for healthcare, GLBA for Banking). More like likely occur.

Some of the factors that come into this include the very nature of criminal sentencing: A judge looks at the facts of the case, aggravating factors, previous convictions and sentencing guidelines, and determines an appropriate sentence.

Then along comes a search engine and doubly punishes someone in what may be a disproportional way; e.g. it's highly unlikely you will come across the convictions of John Smith when you google him, but when you look up someone with a non-common name, it may be the very first search result; disproportionally disadvantaging them for jobs, business and even dating partners.

The issue in this case was Google wanted to be the sole arbiter of what they would remove and what they would leave in, with no oversight from anyone. This would have crippled the GDPR even before it began.

That said, it's early days for the right to be forgotten.