8 ms·

My understanding, as someone implementing the GDPR-compliance for my company right now, is that if you could produce the same one-way hash a second time from th

My understanding, as someone implementing the GDPR-compliance for my company right now, is that if you could produce the same one-way hash a second time from the same input email address then the hash is still considered PI.

tyfon 9y ago
Yep, we've been through this discussion where I work just a few days ago and one way hashing even with salt is _not_ compliant as you can search for whatever you hashed and get a hit (SSNs, emails etc).
- otp124 9y ago
  While GP stated soft-deletes aren't allowed, I figured I'd contribute to this thought exercise. What about symmetric encrypting the field(s) and then giving the customer the key, and tell them to print it or store it safely, or else they won't be able to recover? And then don't store the key or write it to disk (remove it from memory)
  - tyfon 9y ago
    Then you might as well scramble the data completely as the customer is not supposed to be able to recover the data after deletion.
  - mailbag 9y ago
    We're going through a similar thought process now for a blockchain based data-store. If the data is symmetrically encrypted and the key is deleted.. does that count as hard deletion? The data is unrecoverable.
snowwolf 9y ago
Fair point. I can see the purpose of "right to be forgotten", but I think in some circumstances it is going to be abused. Any service that "bans" users for fraudulent/abusive activity and stores data about the banned user to prevent them from creating new accounts is going to have a problem. Banned user can just request to be forgotten and then create a new account. Unless there is some exception within GDPR that will support this use case.
- deleted 9y ago
  [deleted]
- mattmanser 9y ago
  This is probably covered by article 17, 3, e: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ You're allowed to ignore deletion rules for the purposes of: 3 Paragraphs 1 and 2 [the rights to be forgotten] shall not apply to the extent that processing is necessary: (e) for the establishment, exercise or defence of legal claims.
pc86 9y ago
Do you know how you are supposed to handle disputes in the future? If I ask that all my information be deleted and I say n months later I was charged for something I never received, how does the company disprove that?
- the_mitsuhiko 9y ago
  You are legally required to retain payment history anyways for many years. So that's out of the GDPR scope.
  - jacquesm 9y ago
    No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.
    - detaro 9y ago
      GDPR explicitly lists processing that is necessarily to fulfill legal obligations by european or local law as permitted without further permission and as a reason to deny a deletion request, that covers at least a lot of it. (although you still have to report your use to the user and follow general guidelines on handling sensitive data of course)
      - jacquesm 9y ago
        So, it is in scope, since it is covered by the law, and then the law explicitly gives you permission to make an exception. But you'd better do all of the following: - have a legally trained person review your eventual solution and your reasoning behind it - document the exceptions, which laws and which datums it covers - keep track of the law as it changes, especially with new bodies of law such as the GDPR you can expect updates to reflect the situation on the ground and in a way the GDPR itself is such a change. - be prepared to review the situation/code if the law changes in the future - be aware that 'data retention' laws are very different from one industry to another (for instance telecommunications is a totally different beast than e-commerce)

tyfon 9y ago

Yep, we've been through this discussion where I work just a few days ago and one way hashing even with salt is _not_ compliant as you can search for whatever you hashed and get a hit (SSNs, emails etc).

otp124 9y ago
While GP stated soft-deletes aren't allowed, I figured I'd contribute to this thought exercise. What about symmetric encrypting the field(s) and then giving the customer the key, and tell them to print it or store it safely, or else they won't be able to recover? And then don't store the key or write it to disk (remove it from memory)
- tyfon 9y ago
  Then you might as well scramble the data completely as the customer is not supposed to be able to recover the data after deletion.
- mailbag 9y ago
  We're going through a similar thought process now for a blockchain based data-store. If the data is symmetrically encrypted and the key is deleted.. does that count as hard deletion? The data is unrecoverable.

snowwolf 9y ago

Fair point. I can see the purpose of "right to be forgotten", but I think in some circumstances it is going to be abused. Any service that "bans" users for fraudulent/abusive activity and stores data about the banned user to prevent them from creating new accounts is going to have a problem. Banned user can just request to be forgotten and then create a new account. Unless there is some exception within GDPR that will support this use case.

deleted 9y ago
[deleted]
mattmanser 9y ago
This is probably covered by article 17, 3, e: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ You're allowed to ignore deletion rules for the purposes of: 3 Paragraphs 1 and 2 [the rights to be forgotten] shall not apply to the extent that processing is necessary: (e) for the establishment, exercise or defence of legal claims.

pc86 9y ago

Do you know how you are supposed to handle disputes in the future? If I ask that all my information be deleted and I say n months later I was charged for something I never received, how does the company disprove that?

the_mitsuhiko 9y ago
You are legally required to retain payment history anyways for many years. So that's out of the GDPR scope.
- jacquesm 9y ago
  No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.
  - detaro 9y ago
    GDPR explicitly lists processing that is necessarily to fulfill legal obligations by european or local law as permitted without further permission and as a reason to deny a deletion request, that covers at least a lot of it. (although you still have to report your use to the user and follow general guidelines on handling sensitive data of course)
    - jacquesm 9y ago
      So, it is in scope, since it is covered by the law, and then the law explicitly gives you permission to make an exception. But you'd better do all of the following: - have a legally trained person review your eventual solution and your reasoning behind it - document the exceptions, which laws and which datums it covers - keep track of the law as it changes, especially with new bodies of law such as the GDPR you can expect updates to reflect the situation on the ground and in a way the GDPR itself is such a change. - be prepared to review the situation/code if the law changes in the future - be aware that 'data retention' laws are very different from one industry to another (for instance telecommunications is a totally different beast than e-commerce)