4 ms·

I'm still trying to wrap my head around the GDPR myself, but I think (and would love evidence to the contrary if wrong) that IP addresses, certain device attrib

I'm still trying to wrap my head around the GDPR myself, but I think (and would love evidence to the contrary if wrong) that IP addresses, certain device attributes, and the like are okay if they're required in order to ensure (or protect against threats to) "the availability, authenticity, integrity and confidentiality of stored or transmitted personal data". [0] I don't really know about relational data, where a true "delete" would destroy someone's database. Somebody told me that, if hard deletions aren't technically feasible, then soft-deleting (or marking as archived or whatever) is acceptable. Not too sure I believe them though -- simply replacing the sensitive data with garbage and keeping the relations seems like a better idea. [0] https://gdpr-info.eu/recitals/no-49/ https://gdpr-info.eu/recitals/no-49/

deleted 9y ago
[deleted]
geocar 9y ago
> Somebody told me that, if hard deletions aren't technically feasible, then soft-deleting (or marking as archived or whatever) is acceptable. Just also remember to record that you shouldn’t restore that persons data to the pre-forgotten state. The European courts haven’t weighed in, but they’re not unreasonable, and the UK has given specific guidance: https://ico.org.uk/media/for-organisations/documents/1475/deleting_personal_data.pdf https://ico.org.uk/media/for-organisations/documents/1475/de...
- Silhouette 9y ago
  The UK guidance you mentioned there appears to apply to the DPA (the current legislation in this area) and not the GDPR (the new legislation with the stronger rights for deletion etc.).
  - geocar 9y ago
    In what way do you think the GDPR right to erasure is “stronger”?
    - Silhouette 9y ago
      In that no directly comparable right even exists under the current DPA?
      - geocar 9y ago
        That's not really how European law works. huehehue was interested in what the GDPR might mean by erasure and deletion. This is the ICO's opinion about it. It'd be a surprise if they suddenly interpret erasure and deletion differently: There would have to be something in the GDPR that suggests that this isn't good enough.
codedokode 9y ago
You don't need to delete personal information. Just replace all strings with XXX.
rusk 9y ago
Yes. I think this falls under the term "proportionality"

deleted 9y ago

[deleted]

geocar 9y ago

> Somebody told me that, if hard deletions aren't technically feasible, then soft-deleting (or marking as archived or whatever) is acceptable. Just also remember to record that you shouldn’t restore that persons data to the pre-forgotten state. The European courts haven’t weighed in, but they’re not unreasonable, and the UK has given specific guidance: https://ico.org.uk/media/for-organisations/documents/1475/deleting_personal_data.pdf https://ico.org.uk/media/for-organisations/documents/1475/de...

Silhouette 9y ago
The UK guidance you mentioned there appears to apply to the DPA (the current legislation in this area) and not the GDPR (the new legislation with the stronger rights for deletion etc.).
- geocar 9y ago
  In what way do you think the GDPR right to erasure is “stronger”?
  - Silhouette 9y ago
    In that no directly comparable right even exists under the current DPA?
    - geocar 9y ago
      That's not really how European law works. huehehue was interested in what the GDPR might mean by erasure and deletion. This is the ICO's opinion about it. It'd be a surprise if they suddenly interpret erasure and deletion differently: There would have to be something in the GDPR that suggests that this isn't good enough.

codedokode 9y ago

You don't need to delete personal information. Just replace all strings with XXX.

rusk 9y ago

Yes. I think this falls under the term "proportionality"