9 ms·

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't unders

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. I get the desire to have a company forget about you, and remove all the personal information they have. It makes sense from a personal standpoint. But how do you do it technically? If you follow GDPR strictly you would need to be able to purge the data from your backups. Now most backups are considered immutable, so you aren't going to do that, meaning you need a way to ensure that "forgotten" users never get restored. But how do you even delete the live data? Does the tech company you work for have the ability to delete all traces of a user from their system, cleaning severing all relationships with other objects in your system? Do you have the ability to retrieve everything you know about a specific user, and provide it to them? You will need to write the code to do this. There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. Do you sell a SaaS service to businesses, and those businesses send you their customer's data? Then you are the processor and they are the controller. Cool, less for you to do, sort of. Except that controller must agree to every sub-processor you use. Want to switch from AWS to GCP? You can only do it if all your customers agree. Want to use try out a new metrics or logging service? If it will have any PII you can't do it without customer (controller) permission. You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers.

nvarsj 9y ago
> it comes at a huge cost to tech companies Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? I think that's sort of the point - that your business should not rely on tracking individuals and selling that information without their consent to gov/private bodies. It's obviously a huge change, since so many big tech players rely on this to make profits. But the internet will be a much nicer place for everyone else if right to privacy is protected.
- Silhouette 9y ago
  Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? No, unfortunately not.
- taysic 9y ago
  "the application of the GDPR will prevent them from using these personal data for any further purpose unless the user permits." This seems incredibly broad from the article and would touch nearly every startup. Maybe there are limits on the businesses affected? Otherwise I'm not sure how one could formally define "rely heavily on lack of privacy for monetisation."
  - Spivak 9y ago
    This law will affect everyone but it seems like it will devastate companies that have no monetization strategy other than collecting user data and either selling it or mining it for targeted ad placements. https://unroll.me/ https://unroll.me/ is a good example. They provide a free service to users but make money by leveraging their total access to your inbox to sell ad analyics and competitive intelligence.
    - taysic 9y ago
      It could also devastate small companies at an early stage which need to dedicate resources to get into compliance rather than building their product. It might hurt the bad players but it really depends on how readable the text will be to the average user. If it's going to be a checkbox it will likely not do much.
      - the_mitsuhiko 9y ago
        If you build it from the ground up there is not that much work involved. Retrofitting is the complexity.
- closeparen 9y ago
  Doesn't it affect everyone with a user account system, storage of user-generated data, error logging, usage and performance metrics, etc? HN itself is illegal under EU regulations because you can't delete old comments, and we know that the admins know how many RPS they are getting but I haven't specifically opted in to using records of my HTTP requests for traffic monitoring.
bflesch 9y ago
Thanks for phrasing your concerns about this regulation in such a nice way. I tried to articulate it in an earlier post but it was very controversially received. Overall, this will be yet another additional challenge for EU-based startups in comparison with their US peers and keep armies of lawyers busy.
- austinheap 9y ago
  I just want to point out it keeps armies of US engineers employed too. The amount of work I've had for EU companies implementing their EU regulations as a US tech worker is confusing and funny. This is just another opportunity for easy money if you're in the states and enjoy/don't mind compliance work.
  - deleted 9y ago
    [deleted]
  - deleted 9y ago
    [deleted]
  - taysic 9y ago
    It's good in your working for a large company in the States but not great if you're working for a small company in the EU.
- M2Ys4U 9y ago
  If a US company wants to handle the data of an EU citizen then they'll have to comply or be fined as well. And if you're complying because you want users in the EU, then you might as well design your system to comply for everybody. And that's a Good Thing as more privacy is better.
bjl 9y ago
> You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers. Or they could, I don't know, just not collect that data in the first place.
- hayksaakian 9y ago
  What if you run an online payroll service? This type of SaaS obviously requires you to collect personal information. Do you think it's reasonable to have to get individual user approval to move their data from one database vendor to another?
  - bjl 9y ago
    > What if you run an online payroll service? Then you should already be treating your data in this way. If you're not, then I'm glad you're being forced to now. As for your other point, sure. Customers should absolutely have a say in what happens to their data.
- antoncohen 9y ago
  It isn't that simple. When people think about these privacy laws that is what they think about, some evil corporation tracking tons of private info. The company I work for has no ads. It does no analytics on personal info. It does nothing you would care about. What it is is a SasS product for businesses. We aren't the controller, so we don't need permission from end users, our customers need to get permission from their customers. But end users can ask our customer (the controller) to delete data, and our customer can ask us (the processor) to delete it. Fine, we now have an engineer building GDPR features instead of features that benefit our customers. Oh well. But it isn't as clear a win for end users as people make it out to be when they only come at it from an anti-Google and anti-Facebook perspective. It sounds good in theory, but things like Article 28 certainly make it harder to move quickly. > The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.
ubernostrum 9y ago
First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content I think a lot of EU people (I'm not one) would disagree with you here. The notions of privacy and of the goals of the criminal-justice system in several parts of Europe are radically different from the notions your "common sense" position is based on, which means that what seems "common sense" to them seems ludicrous to you, and vice-versa.
- closeparen 9y ago
  It may surprise some HN readers that 1984 was in fact not about a lack of pricacy, but about the government's ability to edit the past. Privacy had a minor role next to the ability to redefine the truth. This is a deeply scary thing. I hope the gleefully self-righteous dystopia builders in this thread get to suffer the full pain of the "right to edit other people's memories" world they are building.
Joeri 9y ago
You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. And as far as this stuff being difficult to do, sure, but isn't it worth doing? Why shouldn't a customer have a say which cloud provider hosts their data? Why shouldn't we be able to make sure no data is kept about us after we stop using a service? Like with anything novel in software it only seems hard to do because we haven't done it, but in a ground up design it's not that hard to add gdpr compliance, and a few years down the line this stuff will be business as usual. You don't need a compliance officer, but you do need a security officer, and their job now also involves data lineage, not just data security. You already should have that person if you're building a SaaS solution.
- antoncohen 9y ago
  > You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. I was referring to Google vs. Costeja, which I realize isn't GDPR, but an EU court did rule that way. > You don't need a compliance officer, but you do need a security officer I strongly believe that compliance and security are two very different things, that are only slightly related. They come at it from a very different perspectives. A security engineer should be doing threat modeling and protecting against threat vectors. A compliance officer may consult a security engineer, but ultimately their job is to check boxes to make sure regulations are followed. I think compliance staff are more appropriately part of a legal team than an engineering team. That isn't to say compliance officers aren't useful. Having a strong compliance voice can be great. I've seen companies without a compliance officer reduce security because an auditor told them regulations required something. A good compliance officer would have been able to push back against the auditors, pointing out what regulations actually require, and working with the security engineers to come up with a solution that meets regulations and actually improves security.
  - yuhong 9y ago
    To be more precise, I think the problem they are talking about is that they may still need to remove it from search results even if the original source still has the right to continue to process the info. A compromise would be to eventually void this right after a certain time (maybe 2020) via a GDPR exception for example.
cm2187 9y ago
I believe that in many countries there has been laws for a while mandating the deletion of personal data after a certain number of years (for instance I believe this is the case in banking). This is not new and if your backup system does not comply with regulations, it's probably more of a design problem.
- Silhouette 9y ago
  This is not new and if your backup system does not comply with regulations, it's probably more of a design problem. Perhaps, but it's a design problem that approximately 100% of otherwise reasonable backup systems will have, and working around it comprehensively will be extraordinarily expensive. Do we really want to impose rules that incentivize businesses storing personal data on behalf of their customers not to back that data up properly, in order to avoid any potential liability under the GDPR? Because that's exactly what this law does, as it stands.
  - cm2187 9y ago
    It feels like the reaction of a VW engineer complaining that CO2 emissions regulations are making his job complicated. Yeah, if you want the data, you need to be able to handle the data in a compliant way. The other solution is to not collect the data. Keep in mind that this is targeted at user tracking. Don't expect me to be sympathetic to the troubles of backing up all of that tracking data.
    - Silhouette 9y ago
      Yeah, if you want the data, you need to be able to handle the data in a compliant way. The other solution is to not collect the data. But since that data will include things like routine server logs, back-ups of customer records necessary for statutory financial record-keeping purposes, and so on, it's never that easy. With such a broadly written law, you could spend a small fortune on legal advice just to find out what your real, practical obligations are to make a good faith attempt to comply. Keep in mind that this is targeted at user tracking. The intent might have been to go after user tracking, but unfortunately, that's not what the law they made actually says.
Slartie 9y ago
> First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. No, it is about deleting personal data attached to your user account, not "news articles". This thing intends to make the "delete my account" button to actually, you know, "delete my account", instead of fake-deleting it by setting a "deleted" flag and telling me that everything is gone now while still keeping gigabytes of data associated with me in your database. > [...] meaning you need a way to ensure that "forgotten" users never get restored. If this is considered to be a hard problem, then I assume storing some list of deleted users in a separate place and immediately purge those users from the backup after restore must be some kind of rocket science. > There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. I wouldn't call it "to become GDPR compliant", I would call it "to build a sound database structure". Because if you are unable to purge all data associated to one of your users' accounts from your system without destroying the integrity of the rest of your data, then you obviously have a half-baked system at your hands that lacks a core feature - to actually delete accounts. And you surely should spend some of your money to refactor this crap into a long-term viable solution while you are still small and agile enough to do that. Because it's only going to be way more expensive later on...
- spydum 9y ago
  You missed the point: if I take an image backup of a disk and store it, even in encrypted format, and it contains John Doe's account, and he comes along and asks for his account deleted, I would have to purge not just my database record, but the backups images from the past as well. That invalidates ALL of my backups. It's not often practical to backup INDIVIDUAL users..
  - FridgeSeal 9y ago
    This is not an unsolvable problem. Does your data not have a lifetime anyways? Do you really need to store everything forever? If you have system that just tracks changes and one that occasionally records full state, after you delete someone from prod you could simply overwrite old full-state backups with your new, post-deletion backup and update your change-only backups to replace data about that user with `deleted`.
cbr 9y ago
If you follow GDPR strictly you would need to be able to purge the data from your backups. Now most backups are considered immutable, so you aren't going to do that Encrypt with a user-specific key, and destroy that key to drop all backups concerning that user.
- justinjlynn 9y ago
  Don't assume the law makes a distinction between data which is destroyed and data which is irretrievable. I can easily see someone arguing that the data is not destroyed -- there's simply a very, very low chance that anyone will be able to retrieve it. You and I both know that argument makes no sense, but hey, it's the law -- it doesn't have to make sense, it just has to convince a few people with power that you're wrong.
  - solomatov 9y ago
    A similar scheme is used to erase data on SSD. Otherwise, you can't reliably delete any data from them.
- Spivak 9y ago
  This only applies to home grown backup systems. If all you're doing are VM backups of your SQL database there's 0% chance you have the granularity to delete a single user. "Then don't do that" Sure, but now you actually have an imposition because the ability to do this kind of thing can't be done on any commercially available backup system.
- makomk 9y ago
  If the key required to decrypt your backups isn't backed up, you don't have backups. If it is, you're back to the original problem.
solomatov 9y ago
>There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. This isn't actually that complicated if their software is designed from scratch with GDPR in mind. Current approach is collect all the data you can with the intention of selling this to data brokers. GDPRs discourages this. It shouldn't be that complicated and that expensive if you store the minimum amount of information you can to cut costs. > The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers. This can be done away in a way small business hire contractor lawyers and accountants with an hourly rate. If you are small, you shouldn't do anything which might involve high fees from them.
A_No_Name_Mouse 9y ago
> Take the right to be forgotten. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. That is not correct. The right to privacy is not an absolute right. It has to be balanced against other rights, such as the right to free press. In a normal news article case, free press would prevail. > There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. I advise a lot of small customers to implement manual procedures to retrieve or delete data in case a request for it might be done. And to set up a basic privacy and security policy which they should have had already. This doesn't cost much. > Except that controller must agree to every sub-processor you use. This can be a generic agreement where the processor notifies the processor. > Want to switch from AWS to GCP? You can only do it if all your customers agree. Not true, you do however need to be able to tell customers what companies receive their data. Which can be quite a challenge with sub-sub-subcontractors. Want to use try out a new metrics or logging service? If it will have any PII you can't do it without customer (controller) permission. Not true if the processing agreement contains a clause that instructs processor to perform metrics or logging. Customer consent is often not needed unless it has big impact on their privacy. Consent is only one of the legal grounds. > You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers. If this were true I'd be a lot busier. It would be wise if companies assign the responsibility for privacy and security, but it doesn't always need to be a full time job with a level background.
dangerface 9y ago
"the right to be forgotten" This is already in EU data protection law where data needs to be forgotten after its relevancy and a cool down period, it considers and covers things like your example. "purge the data from your backups" Again you should already be doing this if you do business with the EU or you are breaking the law. "Do you have the ability to retrieve everything you know about a specific user" Again this is already in the EU data protection law you should already be able to do this or you have been breaking the law. Im not a lawyer so take this all with a pinch of salt this is just stuff I need to know as an EU developer. Sure it might be slightly more work for US tech companies but I can't be arsed is not a valid reason to break the law. If you think it will cost to much then don't do it, there are plenty of EU companies that do.

nvarsj 9y ago

> it comes at a huge cost to tech companies Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? I think that's sort of the point - that your business should not rely on tracking individuals and selling that information without their consent to gov/private bodies. It's obviously a huge change, since so many big tech players rely on this to make profits. But the internet will be a much nicer place for everyone else if right to privacy is protected.

Silhouette 9y ago
Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? No, unfortunately not.
taysic 9y ago
"the application of the GDPR will prevent them from using these personal data for any further purpose unless the user permits." This seems incredibly broad from the article and would touch nearly every startup. Maybe there are limits on the businesses affected? Otherwise I'm not sure how one could formally define "rely heavily on lack of privacy for monetisation."
- Spivak 9y ago
  This law will affect everyone but it seems like it will devastate companies that have no monetization strategy other than collecting user data and either selling it or mining it for targeted ad placements. https://unroll.me/ https://unroll.me/ is a good example. They provide a free service to users but make money by leveraging their total access to your inbox to sell ad analyics and competitive intelligence.
  - taysic 9y ago
    It could also devastate small companies at an early stage which need to dedicate resources to get into compliance rather than building their product. It might hurt the bad players but it really depends on how readable the text will be to the average user. If it's going to be a checkbox it will likely not do much.
    - the_mitsuhiko 9y ago
      If you build it from the ground up there is not that much work involved. Retrofitting is the complexity.
closeparen 9y ago
Doesn't it affect everyone with a user account system, storage of user-generated data, error logging, usage and performance metrics, etc? HN itself is illegal under EU regulations because you can't delete old comments, and we know that the admins know how many RPS they are getting but I haven't specifically opted in to using records of my HTTP requests for traffic monitoring.

bflesch 9y ago

Thanks for phrasing your concerns about this regulation in such a nice way. I tried to articulate it in an earlier post but it was very controversially received. Overall, this will be yet another additional challenge for EU-based startups in comparison with their US peers and keep armies of lawyers busy.

austinheap 9y ago
I just want to point out it keeps armies of US engineers employed too. The amount of work I've had for EU companies implementing their EU regulations as a US tech worker is confusing and funny. This is just another opportunity for easy money if you're in the states and enjoy/don't mind compliance work.
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
- taysic 9y ago
  It's good in your working for a large company in the States but not great if you're working for a small company in the EU.
M2Ys4U 9y ago
If a US company wants to handle the data of an EU citizen then they'll have to comply or be fined as well. And if you're complying because you want users in the EU, then you might as well design your system to comply for everybody. And that's a Good Thing as more privacy is better.

bjl 9y ago

> You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers. Or they could, I don't know, just not collect that data in the first place.

hayksaakian 9y ago
What if you run an online payroll service? This type of SaaS obviously requires you to collect personal information. Do you think it's reasonable to have to get individual user approval to move their data from one database vendor to another?
- bjl 9y ago
  > What if you run an online payroll service? Then you should already be treating your data in this way. If you're not, then I'm glad you're being forced to now. As for your other point, sure. Customers should absolutely have a say in what happens to their data.
antoncohen 9y ago
It isn't that simple. When people think about these privacy laws that is what they think about, some evil corporation tracking tons of private info. The company I work for has no ads. It does no analytics on personal info. It does nothing you would care about. What it is is a SasS product for businesses. We aren't the controller, so we don't need permission from end users, our customers need to get permission from their customers. But end users can ask our customer (the controller) to delete data, and our customer can ask us (the processor) to delete it. Fine, we now have an engineer building GDPR features instead of features that benefit our customers. Oh well. But it isn't as clear a win for end users as people make it out to be when they only come at it from an anti-Google and anti-Facebook perspective. It sounds good in theory, but things like Article 28 certainly make it harder to move quickly. > The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

ubernostrum 9y ago

First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content I think a lot of EU people (I'm not one) would disagree with you here. The notions of privacy and of the goals of the criminal-justice system in several parts of Europe are radically different from the notions your "common sense" position is based on, which means that what seems "common sense" to them seems ludicrous to you, and vice-versa.

closeparen 9y ago
It may surprise some HN readers that 1984 was in fact not about a lack of pricacy, but about the government's ability to edit the past. Privacy had a minor role next to the ability to redefine the truth. This is a deeply scary thing. I hope the gleefully self-righteous dystopia builders in this thread get to suffer the full pain of the "right to edit other people's memories" world they are building.

Joeri 9y ago

You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. And as far as this stuff being difficult to do, sure, but isn't it worth doing? Why shouldn't a customer have a say which cloud provider hosts their data? Why shouldn't we be able to make sure no data is kept about us after we stop using a service? Like with anything novel in software it only seems hard to do because we haven't done it, but in a ground up design it's not that hard to add gdpr compliance, and a few years down the line this stuff will be business as usual. You don't need a compliance officer, but you do need a security officer, and their job now also involves data lineage, not just data security. You already should have that person if you're building a SaaS solution.

antoncohen 9y ago
> You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. I was referring to Google vs. Costeja, which I realize isn't GDPR, but an EU court did rule that way. > You don't need a compliance officer, but you do need a security officer I strongly believe that compliance and security are two very different things, that are only slightly related. They come at it from a very different perspectives. A security engineer should be doing threat modeling and protecting against threat vectors. A compliance officer may consult a security engineer, but ultimately their job is to check boxes to make sure regulations are followed. I think compliance staff are more appropriately part of a legal team than an engineering team. That isn't to say compliance officers aren't useful. Having a strong compliance voice can be great. I've seen companies without a compliance officer reduce security because an auditor told them regulations required something. A good compliance officer would have been able to push back against the auditors, pointing out what regulations actually require, and working with the security engineers to come up with a solution that meets regulations and actually improves security.
- yuhong 9y ago
  To be more precise, I think the problem they are talking about is that they may still need to remove it from search results even if the original source still has the right to continue to process the info. A compromise would be to eventually void this right after a certain time (maybe 2020) via a GDPR exception for example.

cm2187 9y ago

I believe that in many countries there has been laws for a while mandating the deletion of personal data after a certain number of years (for instance I believe this is the case in banking). This is not new and if your backup system does not comply with regulations, it's probably more of a design problem.

Silhouette 9y ago
This is not new and if your backup system does not comply with regulations, it's probably more of a design problem. Perhaps, but it's a design problem that approximately 100% of otherwise reasonable backup systems will have, and working around it comprehensively will be extraordinarily expensive. Do we really want to impose rules that incentivize businesses storing personal data on behalf of their customers not to back that data up properly, in order to avoid any potential liability under the GDPR? Because that's exactly what this law does, as it stands.
- cm2187 9y ago
  It feels like the reaction of a VW engineer complaining that CO2 emissions regulations are making his job complicated. Yeah, if you want the data, you need to be able to handle the data in a compliant way. The other solution is to not collect the data. Keep in mind that this is targeted at user tracking. Don't expect me to be sympathetic to the troubles of backing up all of that tracking data.
  - Silhouette 9y ago
    Yeah, if you want the data, you need to be able to handle the data in a compliant way. The other solution is to not collect the data. But since that data will include things like routine server logs, back-ups of customer records necessary for statutory financial record-keeping purposes, and so on, it's never that easy. With such a broadly written law, you could spend a small fortune on legal advice just to find out what your real, practical obligations are to make a good faith attempt to comply. Keep in mind that this is targeted at user tracking. The intent might have been to go after user tracking, but unfortunately, that's not what the law they made actually says.

Slartie 9y ago

> First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. No, it is about deleting personal data attached to your user account, not "news articles". This thing intends to make the "delete my account" button to actually, you know, "delete my account", instead of fake-deleting it by setting a "deleted" flag and telling me that everything is gone now while still keeping gigabytes of data associated with me in your database. > [...] meaning you need a way to ensure that "forgotten" users never get restored. If this is considered to be a hard problem, then I assume storing some list of deleted users in a separate place and immediately purge those users from the backup after restore must be some kind of rocket science. > There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. I wouldn't call it "to become GDPR compliant", I would call it "to build a sound database structure". Because if you are unable to purge all data associated to one of your users' accounts from your system without destroying the integrity of the rest of your data, then you obviously have a half-baked system at your hands that lacks a core feature - to actually delete accounts. And you surely should spend some of your money to refactor this crap into a long-term viable solution while you are still small and agile enough to do that. Because it's only going to be way more expensive later on...

spydum 9y ago
You missed the point: if I take an image backup of a disk and store it, even in encrypted format, and it contains John Doe's account, and he comes along and asks for his account deleted, I would have to purge not just my database record, but the backups images from the past as well. That invalidates ALL of my backups. It's not often practical to backup INDIVIDUAL users..
- FridgeSeal 9y ago
  This is not an unsolvable problem. Does your data not have a lifetime anyways? Do you really need to store everything forever? If you have system that just tracks changes and one that occasionally records full state, after you delete someone from prod you could simply overwrite old full-state backups with your new, post-deletion backup and update your change-only backups to replace data about that user with `deleted`.

cbr 9y ago

If you follow GDPR strictly you would need to be able to purge the data from your backups. Now most backups are considered immutable, so you aren't going to do that Encrypt with a user-specific key, and destroy that key to drop all backups concerning that user.

justinjlynn 9y ago
Don't assume the law makes a distinction between data which is destroyed and data which is irretrievable. I can easily see someone arguing that the data is not destroyed -- there's simply a very, very low chance that anyone will be able to retrieve it. You and I both know that argument makes no sense, but hey, it's the law -- it doesn't have to make sense, it just has to convince a few people with power that you're wrong.
- solomatov 9y ago
  A similar scheme is used to erase data on SSD. Otherwise, you can't reliably delete any data from them.
Spivak 9y ago
This only applies to home grown backup systems. If all you're doing are VM backups of your SQL database there's 0% chance you have the granularity to delete a single user. "Then don't do that" Sure, but now you actually have an imposition because the ability to do this kind of thing can't be done on any commercially available backup system.
makomk 9y ago
If the key required to decrypt your backups isn't backed up, you don't have backups. If it is, you're back to the original problem.

solomatov 9y ago

>There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. This isn't actually that complicated if their software is designed from scratch with GDPR in mind. Current approach is collect all the data you can with the intention of selling this to data brokers. GDPRs discourages this. It shouldn't be that complicated and that expensive if you store the minimum amount of information you can to cut costs. > The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers. This can be done away in a way small business hire contractor lawyers and accountants with an hourly rate. If you are small, you shouldn't do anything which might involve high fees from them.

A_No_Name_Mouse 9y ago

> Take the right to be forgotten. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. That is not correct. The right to privacy is not an absolute right. It has to be balanced against other rights, such as the right to free press. In a normal news article case, free press would prevail. > There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. I advise a lot of small customers to implement manual procedures to retrieve or delete data in case a request for it might be done. And to set up a basic privacy and security policy which they should have had already. This doesn't cost much. > Except that controller must agree to every sub-processor you use. This can be a generic agreement where the processor notifies the processor. > Want to switch from AWS to GCP? You can only do it if all your customers agree. Not true, you do however need to be able to tell customers what companies receive their data. Which can be quite a challenge with sub-sub-subcontractors. Want to use try out a new metrics or logging service? If it will have any PII you can't do it without customer (controller) permission. Not true if the processing agreement contains a clause that instructs processor to perform metrics or logging. Customer consent is often not needed unless it has big impact on their privacy. Consent is only one of the legal grounds. > You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers. If this were true I'd be a lot busier. It would be wise if companies assign the responsibility for privacy and security, but it doesn't always need to be a full time job with a level background.

dangerface 9y ago

"the right to be forgotten" This is already in EU data protection law where data needs to be forgotten after its relevancy and a cool down period, it considers and covers things like your example. "purge the data from your backups" Again you should already be doing this if you do business with the EU or you are breaking the law. "Do you have the ability to retrieve everything you know about a specific user" Again this is already in the EU data protection law you should already be able to do this or you have been breaking the law. Im not a lawyer so take this all with a pinch of salt this is just stuff I need to know as an EU developer. Sure it might be slightly more work for US tech companies but I can't be arsed is not a valid reason to break the law. If you think it will cost to much then don't do it, there are plenty of EU companies that do.