4 ms·

I’m currently doing GDPR consulting for an American company. The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups thoug

by geocar 9y ago

I’m currently doing GDPR consulting for an American company. The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. If payment processing stays open for years, then years is fine. I have a customer who keeps data for ten years. The GDPR doesn’t say that a European can claim “right to be forgotten” and force you to destroy invoices proving you did Work for hire. If for some reason they want you to stop processing (right to object) then they end up owing the money themselves- since they can’t force you to forget the invoice, having you unable to send their invoice to insurance sounds like a bad move on their part. Reading the GDPR “at its bluntest” is not the correct way to do things: European courts are not amused by a narrow view of the law when it is used to argue something is technically legal, not do they use their maximum force for minor infraction. That’s why you don’t need to worry about an “enterprising” European taking you to the cleaners because the courts won’t think it’s funny either. It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing.

Silhouette 9y ago
The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. Reading the GDPR “at its bluntest” is not the correct way to do things And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing. Nope, because the right to erasure is not negated because of those sorts of common sense, only specific criteria listed explicitly in the GDPR. And as things stand right now, that right to erasure immediately runs into all the issues of uncertainty raised by many in this discussion and other forums.
- geocar 9y ago
  > And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. If the blocks are deduplicated because the reference count of the bit map remains greater than one then I don't see the problem: Just because John Smith can ask you to delete him from your database doesn't mean he can ask you to delete all John Smiths. Also: European courts aren't amused by this kind of nonsense. > And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. Sure you can. You can look to the historical application of various other similar laws and get an idea of what the regulators are likely to do. For what it's worth: European courts cannot be legally bound to do anything. If they think you're being an asshole but are "technically within the law" they'll still fine you. That's just how it works here: Hurting people is simply not ok. > Nope, because the right to erasure is not negated because of those sorts of common sense It's not "common sense" at all: Being afraid of the government and the police isn't something civilised countries have to deal with. Why would anyone think that the government is trying to hurt people if everyone agrees hurting people is not okay?
fencepost 9y ago
The at least theoretical problem I face is that there are potentially conflicting laws. Sure, that's why courts exist, but courts are expensive. That's why patent trolls try for "settlements" of less than $50k - it's cheaper than defending a case. Theoretical case: 5-doctor pediatric practice running an on-site EMR. Backups include fairly short-duration full images for ease and speed of disaster recovery, plus longer-term file and database backups such that basically no scanned document or received fax will ever be lost from the backups and end-of-month database backups will be retained indefinitely. Beyond a year or two it will be possible for incremental changes to be lost if multiple changes happen within a single month. The practice is required by US law to retain some of that data for years (7, 10, until age 18, 7 years after 18, whatever) or indefinitely (e.g. vaccination records) even if/when the patient leaves the practice. With paper charts that meant that inactive charts went into long-term storage, then eventually were shredded after the expiration of that time period. I'm not sure how vaccination records were kept, but I suspect there were either copies both in the chart and in a separate vaccination-only list or that they were pulled from the charts either before storage or before shredding. There were no backups. With EMRs, there's no good way to pull a single "chart" out of those backups. There are also not separate systems for tracking things depending on how long they have to be retained. In the case of a pediatrician's office then the answer to "how long do you keep the records" is "until the practice closes, and at that point they must be passed along to another practice." As for the case of destroying invoices, it's not that simple. The "invoice" would be the bill sent to the insurance company or patient including diagnostic and procedure codes, but the insurance companies may come back even years later for "chart review" on charges they've paid and in that case they're not looking for the codes they're looking for the supporting documentation in the patient chart. Finally, regarding "enterprising" attorneys wasn't there a whole situation some years back where third party attorneys in Germany were going after alleged copyright infringers "on behalf of" companies that had never heard of them? My Google-fu failed me on this, but I didn't spend a huge amount of time looking. Is there a comparable risk here? I'm not worried about someone actually getting hit with a 10 million Euro fine, I'm more worried about that annoyance-factor "Remove my client's data from the data that you are required by law to keep, come to Europe to defend your failure to do so, or pay my client to abandon this action."
- 9y ago

by geocar 9y ago

Silhouette 9y ago

The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. Reading the GDPR “at its bluntest” is not the correct way to do things And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing. Nope, because the right to erasure is not negated because of those sorts of common sense, only specific criteria listed explicitly in the GDPR. And as things stand right now, that right to erasure immediately runs into all the issues of uncertainty raised by many in this discussion and other forums.

geocar 9y ago
> And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. If the blocks are deduplicated because the reference count of the bit map remains greater than one then I don't see the problem: Just because John Smith can ask you to delete him from your database doesn't mean he can ask you to delete all John Smiths. Also: European courts aren't amused by this kind of nonsense. > And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. Sure you can. You can look to the historical application of various other similar laws and get an idea of what the regulators are likely to do. For what it's worth: European courts cannot be legally bound to do anything. If they think you're being an asshole but are "technically within the law" they'll still fine you. That's just how it works here: Hurting people is simply not ok. > Nope, because the right to erasure is not negated because of those sorts of common sense It's not "common sense" at all: Being afraid of the government and the police isn't something civilised countries have to deal with. Why would anyone think that the government is trying to hurt people if everyone agrees hurting people is not okay?

fencepost 9y ago

The at least theoretical problem I face is that there are potentially conflicting laws. Sure, that's why courts exist, but courts are expensive. That's why patent trolls try for "settlements" of less than $50k - it's cheaper than defending a case. Theoretical case: 5-doctor pediatric practice running an on-site EMR. Backups include fairly short-duration full images for ease and speed of disaster recovery, plus longer-term file and database backups such that basically no scanned document or received fax will ever be lost from the backups and end-of-month database backups will be retained indefinitely. Beyond a year or two it will be possible for incremental changes to be lost if multiple changes happen within a single month. The practice is required by US law to retain some of that data for years (7, 10, until age 18, 7 years after 18, whatever) or indefinitely (e.g. vaccination records) even if/when the patient leaves the practice. With paper charts that meant that inactive charts went into long-term storage, then eventually were shredded after the expiration of that time period. I'm not sure how vaccination records were kept, but I suspect there were either copies both in the chart and in a separate vaccination-only list or that they were pulled from the charts either before storage or before shredding. There were no backups. With EMRs, there's no good way to pull a single "chart" out of those backups. There are also not separate systems for tracking things depending on how long they have to be retained. In the case of a pediatrician's office then the answer to "how long do you keep the records" is "until the practice closes, and at that point they must be passed along to another practice." As for the case of destroying invoices, it's not that simple. The "invoice" would be the bill sent to the insurance company or patient including diagnostic and procedure codes, but the insurance companies may come back even years later for "chart review" on charges they've paid and in that case they're not looking for the codes they're looking for the supporting documentation in the patient chart. Finally, regarding "enterprising" attorneys wasn't there a whole situation some years back where third party attorneys in Germany were going after alleged copyright infringers "on behalf of" companies that had never heard of them? My Google-fu failed me on this, but I didn't spend a huge amount of time looking. Is there a comparable risk here? I'm not worried about someone actually getting hit with a 10 million Euro fine, I'm more worried about that annoyance-factor "Remove my client's data from the data that you are required by law to keep, come to Europe to defend your failure to do so, or pay my client to abandon this action."

9y ago