3 ms·

Erasure of data, on demand, is a requirement of GDPR[0], which becomes law in Europe on 25 May 2018. Note that erasure of the data is required, not just its di

Erasure of data, on demand, is a requirement of GDPR[0], which becomes law in Europe on 25 May 2018. Note that erasure of the data is required, not just its display. IANAL, but the above appears to be contrary to GDPR. [0] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

soapdog 9y ago
I am not a lawyer either, but doing a quick read on the scope, I found in first phrase: "The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU." And this might not apply as there is no data controller, organization or company. You data is on your computer and it replicates that data to friends and friends of friends. There is no cloud or service involved, it is from one machine to the other, I believe someone that has real knowledge of legal matters and p2p should chime in. I am also a bit lost regarding this.
- rmc 9y ago
  Surely that means that the people who replicate it from your ("your friends" and "your friends of friends") would be required to delete the (personal) data?
  - jovdg 9y ago
    So I could require anyone inside the EU to delete any mail they received from me? (I'm in the EU)
    - 0x445442 9y ago
      Yeah, email was the first thing I thought of as well. Surely that doesn't apply.
- auxbuss 9y ago
  I contacted an e-chum who is a lawyer specialising in the field of IT, IP and media law [0]. He pointed me back to Article 17 of the Regulation, Right to erasure ('right to be forgotten'), which is contained in [1]. This states that: "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ... where .. the data subject withdraws consent on which the processing is based..." Paul also expressed the view that: "It’s certainly been written in a way that should require systems to be created to allow for the deletion of personal data, though!" That intent is key here. Basically: if someone asks you to remove their data and you refuse (or fudge, etc.), then don't be surprised if the EU comes knocking. [0] https://www.uea.ac.uk/law/people/profile/paul-bernal https://www.uea.ac.uk/law/people/profile/paul-bernal [1] http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...

soapdog 9y ago

I am not a lawyer either, but doing a quick read on the scope, I found in first phrase: "The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU." And this might not apply as there is no data controller, organization or company. You data is on your computer and it replicates that data to friends and friends of friends. There is no cloud or service involved, it is from one machine to the other, I believe someone that has real knowledge of legal matters and p2p should chime in. I am also a bit lost regarding this.

rmc 9y ago
Surely that means that the people who replicate it from your ("your friends" and "your friends of friends") would be required to delete the (personal) data?
- jovdg 9y ago
  So I could require anyone inside the EU to delete any mail they received from me? (I'm in the EU)
  - 0x445442 9y ago
    Yeah, email was the first thing I thought of as well. Surely that doesn't apply.
auxbuss 9y ago
I contacted an e-chum who is a lawyer specialising in the field of IT, IP and media law [0]. He pointed me back to Article 17 of the Regulation, Right to erasure ('right to be forgotten'), which is contained in [1]. This states that: "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ... where .. the data subject withdraws consent on which the processing is based..." Paul also expressed the view that: "It’s certainly been written in a way that should require systems to be created to allow for the deletion of personal data, though!" That intent is key here. Basically: if someone asks you to remove their data and you refuse (or fudge, etc.), then don't be surprised if the EU comes knocking. [0] https://www.uea.ac.uk/law/people/profile/paul-bernal https://www.uea.ac.uk/law/people/profile/paul-bernal [1] http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...