4 ms·

Looks like that's addressed: > "The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organizat

by grzm 9y ago

Looks like that's addressed: > "The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU." https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Scope https://en.wikipedia.org/wiki/General_Data_Protection_Regula... (However, this is off-topic for this submission specifically.)

j_s 9y ago
> (However, this is off-topic for this submission specifically.) I think it's on-topic for a database that (in my barely informed understanding) is famous for never deleting anything!
- grzm 9y ago
  This is explicitly supported in Datomic via an operation known as "excision": > "Excision is the complete removal of a set of datoms matching a predicate. Excision should be a very infrequent operation, and is designed to support the following two scenarios:" > "- removing data for privacy reasons" > "- removing data older than some domain-defined retention period" > "Excision should never be used to correct erroneous data, and is unsuitable for that task as it does not restore any previous view of the facts. Consider using ordinary retraction to correct errors without removing history." https://docs.datomic.com/on-prem/excision.html https://docs.datomic.com/on-prem/excision.html I haven't read whether or not there's a difference here with respect to the cloud offering, as I wasn't able to find a corresponding Reference section in the cloud docs. However, given that :db/excise is a transaction operation, it's likely supported. Edit to add: Looks like it currently isn't, see 'davidrupp below. That's important to keep in mind.
  - deleted 9y ago
    [deleted]
  - davidrupp 9y ago
    https://docs.datomic.com/on-prem/moving-to-cloud.html https://docs.datomic.com/on-prem/moving-to-cloud.html -> "Other Differences" -> Cloud: "no excision" (edit: "currently")
    - grzm 9y ago
      Thanks for finding this!
auggierose 9y ago
> "Furthermore the regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents." It's really not clear to me how a company like datomic would cope with that in any practical way. Are they supposed to know what kind of data their clients store??
- grzm 9y ago
  I agree these are important questions, and they apply equally to various offerings in AWS, Google, Microsoft, and others. It's not something specific to Datomic.
- NoNotTheDuo 9y ago
  I attended a GDPR session at Re:Invent this year. Basically, there's two types of organizations: data controllers and processors. Datatomic, AWS, Azure, etc. would all fall into the processors category. Amazon.com, however, would fall into the data controller category. From a processor perspective, they have their own requirements/regulations: https://aws.amazon.com/blogs/security/aws-and-the-general-data-protection-regulation/ https://aws.amazon.com/blogs/security/aws-and-the-general-da... See also: https://aws.amazon.com/compliance/eu-data-protection/ https://aws.amazon.com/compliance/eu-data-protection/ AWS/Datomic doesn't need to know what kind of data their customers store - it's up to the customer to be compliant with their part of GDPR.

by grzm 9y ago

j_s 9y ago

> (However, this is off-topic for this submission specifically.) I think it's on-topic for a database that (in my barely informed understanding) is famous for never deleting anything!

grzm 9y ago
This is explicitly supported in Datomic via an operation known as "excision": > "Excision is the complete removal of a set of datoms matching a predicate. Excision should be a very infrequent operation, and is designed to support the following two scenarios:" > "- removing data for privacy reasons" > "- removing data older than some domain-defined retention period" > "Excision should never be used to correct erroneous data, and is unsuitable for that task as it does not restore any previous view of the facts. Consider using ordinary retraction to correct errors without removing history." https://docs.datomic.com/on-prem/excision.html https://docs.datomic.com/on-prem/excision.html I haven't read whether or not there's a difference here with respect to the cloud offering, as I wasn't able to find a corresponding Reference section in the cloud docs. However, given that :db/excise is a transaction operation, it's likely supported. Edit to add: Looks like it currently isn't, see 'davidrupp below. That's important to keep in mind.
- deleted 9y ago
  [deleted]
- davidrupp 9y ago
  https://docs.datomic.com/on-prem/moving-to-cloud.html https://docs.datomic.com/on-prem/moving-to-cloud.html -> "Other Differences" -> Cloud: "no excision" (edit: "currently")
  - grzm 9y ago
    Thanks for finding this!

auggierose 9y ago

> "Furthermore the regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents." It's really not clear to me how a company like datomic would cope with that in any practical way. Are they supposed to know what kind of data their clients store??

grzm 9y ago
I agree these are important questions, and they apply equally to various offerings in AWS, Google, Microsoft, and others. It's not something specific to Datomic.
NoNotTheDuo 9y ago
I attended a GDPR session at Re:Invent this year. Basically, there's two types of organizations: data controllers and processors. Datatomic, AWS, Azure, etc. would all fall into the processors category. Amazon.com, however, would fall into the data controller category. From a processor perspective, they have their own requirements/regulations: https://aws.amazon.com/blogs/security/aws-and-the-general-data-protection-regulation/ https://aws.amazon.com/blogs/security/aws-and-the-general-da... See also: https://aws.amazon.com/compliance/eu-data-protection/ https://aws.amazon.com/compliance/eu-data-protection/ AWS/Datomic doesn't need to know what kind of data their customers store - it's up to the customer to be compliant with their part of GDPR.