4 ms·

You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. And as far as this stuff being difficul

by Joeri 9y ago

You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. And as far as this stuff being difficult to do, sure, but isn't it worth doing? Why shouldn't a customer have a say which cloud provider hosts their data? Why shouldn't we be able to make sure no data is kept about us after we stop using a service? Like with anything novel in software it only seems hard to do because we haven't done it, but in a ground up design it's not that hard to add gdpr compliance, and a few years down the line this stuff will be business as usual. You don't need a compliance officer, but you do need a security officer, and their job now also involves data lineage, not just data security. You already should have that person if you're building a SaaS solution.

antoncohen 9y ago
> You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. I was referring to Google vs. Costeja, which I realize isn't GDPR, but an EU court did rule that way. > You don't need a compliance officer, but you do need a security officer I strongly believe that compliance and security are two very different things, that are only slightly related. They come at it from a very different perspectives. A security engineer should be doing threat modeling and protecting against threat vectors. A compliance officer may consult a security engineer, but ultimately their job is to check boxes to make sure regulations are followed. I think compliance staff are more appropriately part of a legal team than an engineering team. That isn't to say compliance officers aren't useful. Having a strong compliance voice can be great. I've seen companies without a compliance officer reduce security because an auditor told them regulations required something. A good compliance officer would have been able to push back against the auditors, pointing out what regulations actually require, and working with the security engineers to come up with a solution that meets regulations and actually improves security.
- yuhong 9y ago
  To be more precise, I think the problem they are talking about is that they may still need to remove it from search results even if the original source still has the right to continue to process the info. A compromise would be to eventually void this right after a certain time (maybe 2020) via a GDPR exception for example.
- deleted 9y ago
  [deleted]

by Joeri 9y ago

antoncohen 9y ago

> You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. I was referring to Google vs. Costeja, which I realize isn't GDPR, but an EU court did rule that way. > You don't need a compliance officer, but you do need a security officer I strongly believe that compliance and security are two very different things, that are only slightly related. They come at it from a very different perspectives. A security engineer should be doing threat modeling and protecting against threat vectors. A compliance officer may consult a security engineer, but ultimately their job is to check boxes to make sure regulations are followed. I think compliance staff are more appropriately part of a legal team than an engineering team. That isn't to say compliance officers aren't useful. Having a strong compliance voice can be great. I've seen companies without a compliance officer reduce security because an auditor told them regulations required something. A good compliance officer would have been able to push back against the auditors, pointing out what regulations actually require, and working with the security engineers to come up with a solution that meets regulations and actually improves security.

yuhong 9y ago
To be more precise, I think the problem they are talking about is that they may still need to remove it from search results even if the original source still has the right to continue to process the info. A compromise would be to eventually void this right after a certain time (maybe 2020) via a GDPR exception for example.
deleted 9y ago
[deleted]