7 ms·

Yes it surely creates some work for companies, but on the other hand what good would it be if you could just keep personal data around just because it happens t

Yes it surely creates some work for companies, but on the other hand what good would it be if you could just keep personal data around just because it happens to be on a backup tape? Companies simply have to implement suitable backup schedules, which will ensure that the data gets deleted within an acceptable time period (e.g. two weeks), which is doable without actively erasing any specific data (instead of simply erasing a whole backup version).

Silhouette 10y ago
You and I have very different definitions of the word "simply". Arranging proper backups at all is not something to take for granted when you're dealing with small businesses that have many other things to do, but obviously they're important for safeguarding the provision of products and services to all customers and it's important that any backups that are made are handled with proper regard to both security and integrity. Requiring businesses to separate every tiny item of data that might ever be legally required from every tiny item of data that is collected and used with consent for reasonable purposes, just in case some customer one day decides to retrospectively withdraw their consent for some or all of that data, could easily become absurdly disproportionate. I hope it would go without saying that incentivizing businesses not to keep backups of all important data because of the compliance overheads is insane. However, without such fine-grained separation, two weeks might be far too short a period to keep backups. To use my own businesses as an example here, we have accounting and reporting obligations that potentially require several years of data. The reporting information is typically derived once a year during reporting season, from straightforward records kept in the main databases and/or spreadsheets. However, we would probably have to completely restructure those records and denormalize all kinds of things in order to delete everything we don't strictly need for some legal purpose, which would be a huge amount of work. That's just the structure of the original data. Then you have to consider things like deduplication in online backup services, where it's practically impossible to guarantee the complete destruction of all instances of certain data without destroying all backups that ever involved that data and starting over. If this is the situation for small businesses that typically only collect a small amount of personal data in the first place and for obvious and necessary purposes, I shudder to think of the implications for organisations that actually process personal data as part of their main purpose rather than incidentally. I'm not sure it's reasonable to assume, in general, that it would even be possible to totally separate legally required data from everything else in such organisations, and there would surely be a lot of grey areas. Now, please don't misunderstand me. I'm all for reasonable regulation to protect individuals from exploitation. I'm a privacy and civil liberties advocate, and I run my own businesses the way I hope others would run theirs, even if sometimes that means not doing things that would probably make us more money because they also make us feel uncomfortable. But there has to be a sensible balance, and the EU does not have a good track record of balancing its business regulations sensibly. (See also: EU VAT, cookie law, various provisions in the last round of consumer protection rules, etc.)
- ThePhysicist 10y ago
  Companies need to separate personal data from other data as early as possible. Yes, this requires some work and rethinking of data structures, it is doable though. Why would it be impossible to do this in your opinion? Do you have a more concrete example that we can discuss? In General, I think requiring that companies do not hold on to your personal data indefinitely is a pretty reasonable regulation. If there were exceptions e.g. for backup data it would provide a convenient loophole for companies to keep the data. Also, if companies keep copies of their personal data lying around it increases the risk of the data being stolen or leaked into the public. We have seen that even for the largest companies it's impossible to avoid "losing" data once in a while, so making sure that this data contains the least amount of sensitive information possible is very reasonable. The regulation does not even assume that companies are malicious, it just assumes that sh*t happens and tries to mitigate potential damage to individuals.
  - Silhouette 10y ago
    Companies need to separate personal data from other data as early as possible. Yes, this requires some work and rethinking of data structures, it is doable though. Why would it be impossible to do this in your opinion? I'm very wary of making that assumption, because so much data could potentially be personal data even if it's not obvious. Remember that the real criterion here is data that is or could be linked to an identified individual. With the kind of progress being made with data mining and analysis and the kind of processing power being devoted to those activities today, there are few safe assumptions any more about what becomes impersonal data just because it's been "aggregated" or "pseudonymised". Let's consider a common example. Suppose a business operates a web site, and like most such businesses it keeps server logs. Those logs are useful for a wide variety of purposes and some of the data may remain useful for long periods, to allow analysis of things like how the site is being used or whether certain patterns are useful for detecting potential threats, or even to provide evidence that a customer did in fact use the services on the site during a certain period in the event of a dispute over charges. In themselves, those logs probably don't inherently contain personal data. However, each record does have data such as IP addresses within it, which may be quite easy to link to a specific customer in practice and thus make everything in that record into personal data. Now, suppose a customer who has been using that site for a while stops, and then files a notice to remove all personal data about them that the site operator isn't legally allowed to keep despite that notice. In order to comply with that request, must the site operator therefore delete all records based on the server logs, including any backups or derived data, to which that customer might be connected? I can't immediately see why the site operator would be allowed to keep those records with a literal reading of the new rules. However, removing them would potentially undermine useful and reasonable business functions such as those mentioned above. Moreover, the cost of doing so might be substantial, and the adjustments required so the infrastructure used to process those logs can support this sort of retrospective editing might also be substantial. In such a case, I think the balance would usually be too far towards the individual. The imposition on the site operator is great, both in the effort to comply with the request itself and in the damaging effects on reasonable business practices. The risk to the visitor of that potentially identifiable data being used for typical purposes in connection with server logs is low. Unless there are other relevant factors that point the other way (perhaps if the site deals with a particularly sensitive subject) the cost to the site operator is almost certainly disproportionate to the benefit to the individual.

Silhouette 10y ago

You and I have very different definitions of the word "simply". Arranging proper backups at all is not something to take for granted when you're dealing with small businesses that have many other things to do, but obviously they're important for safeguarding the provision of products and services to all customers and it's important that any backups that are made are handled with proper regard to both security and integrity. Requiring businesses to separate every tiny item of data that might ever be legally required from every tiny item of data that is collected and used with consent for reasonable purposes, just in case some customer one day decides to retrospectively withdraw their consent for some or all of that data, could easily become absurdly disproportionate. I hope it would go without saying that incentivizing businesses not to keep backups of all important data because of the compliance overheads is insane. However, without such fine-grained separation, two weeks might be far too short a period to keep backups. To use my own businesses as an example here, we have accounting and reporting obligations that potentially require several years of data. The reporting information is typically derived once a year during reporting season, from straightforward records kept in the main databases and/or spreadsheets. However, we would probably have to completely restructure those records and denormalize all kinds of things in order to delete everything we don't strictly need for some legal purpose, which would be a huge amount of work. That's just the structure of the original data. Then you have to consider things like deduplication in online backup services, where it's practically impossible to guarantee the complete destruction of all instances of certain data without destroying all backups that ever involved that data and starting over. If this is the situation for small businesses that typically only collect a small amount of personal data in the first place and for obvious and necessary purposes, I shudder to think of the implications for organisations that actually process personal data as part of their main purpose rather than incidentally. I'm not sure it's reasonable to assume, in general, that it would even be possible to totally separate legally required data from everything else in such organisations, and there would surely be a lot of grey areas. Now, please don't misunderstand me. I'm all for reasonable regulation to protect individuals from exploitation. I'm a privacy and civil liberties advocate, and I run my own businesses the way I hope others would run theirs, even if sometimes that means not doing things that would probably make us more money because they also make us feel uncomfortable. But there has to be a sensible balance, and the EU does not have a good track record of balancing its business regulations sensibly. (See also: EU VAT, cookie law, various provisions in the last round of consumer protection rules, etc.)

ThePhysicist 10y ago
Companies need to separate personal data from other data as early as possible. Yes, this requires some work and rethinking of data structures, it is doable though. Why would it be impossible to do this in your opinion? Do you have a more concrete example that we can discuss? In General, I think requiring that companies do not hold on to your personal data indefinitely is a pretty reasonable regulation. If there were exceptions e.g. for backup data it would provide a convenient loophole for companies to keep the data. Also, if companies keep copies of their personal data lying around it increases the risk of the data being stolen or leaked into the public. We have seen that even for the largest companies it's impossible to avoid "losing" data once in a while, so making sure that this data contains the least amount of sensitive information possible is very reasonable. The regulation does not even assume that companies are malicious, it just assumes that sh*t happens and tries to mitigate potential damage to individuals.
- Silhouette 10y ago
  Companies need to separate personal data from other data as early as possible. Yes, this requires some work and rethinking of data structures, it is doable though. Why would it be impossible to do this in your opinion? I'm very wary of making that assumption, because so much data could potentially be personal data even if it's not obvious. Remember that the real criterion here is data that is or could be linked to an identified individual. With the kind of progress being made with data mining and analysis and the kind of processing power being devoted to those activities today, there are few safe assumptions any more about what becomes impersonal data just because it's been "aggregated" or "pseudonymised". Let's consider a common example. Suppose a business operates a web site, and like most such businesses it keeps server logs. Those logs are useful for a wide variety of purposes and some of the data may remain useful for long periods, to allow analysis of things like how the site is being used or whether certain patterns are useful for detecting potential threats, or even to provide evidence that a customer did in fact use the services on the site during a certain period in the event of a dispute over charges. In themselves, those logs probably don't inherently contain personal data. However, each record does have data such as IP addresses within it, which may be quite easy to link to a specific customer in practice and thus make everything in that record into personal data. Now, suppose a customer who has been using that site for a while stops, and then files a notice to remove all personal data about them that the site operator isn't legally allowed to keep despite that notice. In order to comply with that request, must the site operator therefore delete all records based on the server logs, including any backups or derived data, to which that customer might be connected? I can't immediately see why the site operator would be allowed to keep those records with a literal reading of the new rules. However, removing them would potentially undermine useful and reasonable business functions such as those mentioned above. Moreover, the cost of doing so might be substantial, and the adjustments required so the infrastructure used to process those logs can support this sort of retrospective editing might also be substantial. In such a case, I think the balance would usually be too far towards the individual. The imposition on the site operator is great, both in the effort to comply with the request itself and in the damaging effects on reasonable business practices. The risk to the visitor of that potentially identifiable data being used for typical purposes in connection with server logs is low. Unless there are other relevant factors that point the other way (perhaps if the site deals with a particularly sensitive subject) the cost to the site operator is almost certainly disproportionate to the benefit to the individual.