5 ms·

IANAL, but isn’t "true deletion" legally required under GDPR? Wouldn't leaving personal data lying around in your database like this technically leave you liab

IANAL, but isn’t "true deletion" legally required under GDPR? Wouldn't leaving personal data lying around in your database like this technically leave you liable to massive fines?

scrollaway 9y ago
AFAIK GDPR mandates that deleted data is no longer processed (used for marketing, analyzed, etc). I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry.
- metaobject 9y ago
  Furthermore, I'd imagine that the host might be required to retain those records for law enforcement purposes (imagine if someone made death threats, etc and law enforcement requested those records for an investigation).
  - zaarn 9y ago
    GDPR does have exceptions for legal compliance, yes. If someone does something illegal and they request deletions you can (IMO, not a lawyer) retain the records if you know there is an investigation or court case going or strongly suspect so or initiate it yourself.
    - asfdsfggtfd 9y ago
      You may even be able to keep comments/posts for longer for general compliance. You will need an audit explaining why and to be prepared to defend it. You won't be able to use such data for analytics. This is based on my personal layman's understanding. I am NOT a lawyer. I am NOT your lawyer. If you need legal advice consult a competent lawyer in your jurisdiction.
    - HenryBemis 9y ago
      Legal/Regulatory compliance is not for Facebook or Amazon. It is to prevent people going to their Bank, where they have a credit card or a consumer loan, or a mortgage, and say "can I please be forgotten/be wiped from your systems - oh and the loan too!".
- microcolonel 9y ago
  > I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry. You just store the keys separately, assuming one-way encryption (losing the key) counts as deletion.
- talaketu 9y ago
  IANAL - no idea what "erasure" as in the "Right to erasure" means http://www.privacy-regulation.eu/en/article-17-right-to-erasure-%27right-to-be-forgotten%27-GDPR.htm http://www.privacy-regulation.eu/en/article-17-right-to-eras... But... if deleted data is no longer processed, does that mean it can not longer be used for targeting etc?
- asfdsfggtfd 9y ago
  It means deleted as in gone. Your backups should be cycled after a few months and the deleted data will eventually not be present in any backups.
freeone3000 9y ago
Prove we didn't delete it.
- unclebucknasty 9y ago
  It would require a whistleblower, which could definitely happen.
  - daveFNbuck 9y ago
    Especially if they give a percentage of the fine to the whistleblower.
    - sjwright 9y ago
      1% of 4% of Facebook's annual revenue sounds like a good deal to me. Who wouldn't be a whistleblower for $15MM
- simias 9y ago
  It would be extremely risky for such a huge company to pull a stunt like that. All it would take is for one employee to become a whistleblower to put the company into a legal and PR quagmire. And all that for what? Losing 0.1% of their data because of people deleting their account? Not worth it IMO.
  - TheSpiceIsLife 9y ago
    In which event Huge Company finds the lowest level employee they can reasonably pin the blame on.
    - isostatic 9y ago
      But they still get fined 4% of their global revenue. A few $1.5bn fines and they'll learn how to delete.
      - 9y ago
thomed 9y ago
There’s a bunch of cases where a business should not delete data even if requested by a user; the biggie is crime/fraud prevention. However, if that data was later disclosed in a breach the company would be subject to penalties. The request for removal does count as rescinding consent, so you would no longer be able to do anything that required consent anyhow. Data could be thought of as radioactive so long as it has a unique identifier. If you can aggregate your fraud detection data in some way to remove the pseudonymous/personal identifiers then you should. If you can’t, then your usecase needs to justify the risk of keeping that radioactive material around. Watch out that your aggregates can’t be reverse engineered though. There’s a reasonableness test around how easy it would be to recompile a users profile etc. As technology advances things that were once unreasonable become reasonable think md5). I find it helpful to think of reasonableness being connected to the best 10 people you recently interviewed, or the actions of any competitor in the space. If a prosecutor can point to the competitor and ask why you didn’t do what they did, you need a very good reason to pass reasonableness.
asfdsfggtfd 9y ago
Yes.

IANAL, but isn’t "true deletion" legally required under GDPR? Wouldn't leaving personal data lying around in your database like this technically leave you liable to massive fines?

scrollaway 9y ago

AFAIK GDPR mandates that deleted data is no longer processed (used for marketing, analyzed, etc). I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry.

metaobject 9y ago
Furthermore, I'd imagine that the host might be required to retain those records for law enforcement purposes (imagine if someone made death threats, etc and law enforcement requested those records for an investigation).
- zaarn 9y ago
  GDPR does have exceptions for legal compliance, yes. If someone does something illegal and they request deletions you can (IMO, not a lawyer) retain the records if you know there is an investigation or court case going or strongly suspect so or initiate it yourself.
  - asfdsfggtfd 9y ago
    You may even be able to keep comments/posts for longer for general compliance. You will need an audit explaining why and to be prepared to defend it. You won't be able to use such data for analytics. This is based on my personal layman's understanding. I am NOT a lawyer. I am NOT your lawyer. If you need legal advice consult a competent lawyer in your jurisdiction.
  - HenryBemis 9y ago
    Legal/Regulatory compliance is not for Facebook or Amazon. It is to prevent people going to their Bank, where they have a credit card or a consumer loan, or a mortgage, and say "can I please be forgotten/be wiped from your systems - oh and the loan too!".
microcolonel 9y ago
> I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry. You just store the keys separately, assuming one-way encryption (losing the key) counts as deletion.
talaketu 9y ago
IANAL - no idea what "erasure" as in the "Right to erasure" means http://www.privacy-regulation.eu/en/article-17-right-to-erasure-%27right-to-be-forgotten%27-GDPR.htm http://www.privacy-regulation.eu/en/article-17-right-to-eras... But... if deleted data is no longer processed, does that mean it can not longer be used for targeting etc?
asfdsfggtfd 9y ago
It means deleted as in gone. Your backups should be cycled after a few months and the deleted data will eventually not be present in any backups.

freeone3000 9y ago

Prove we didn't delete it.

unclebucknasty 9y ago
It would require a whistleblower, which could definitely happen.
- daveFNbuck 9y ago
  Especially if they give a percentage of the fine to the whistleblower.
  - sjwright 9y ago
    1% of 4% of Facebook's annual revenue sounds like a good deal to me. Who wouldn't be a whistleblower for $15MM
simias 9y ago
It would be extremely risky for such a huge company to pull a stunt like that. All it would take is for one employee to become a whistleblower to put the company into a legal and PR quagmire. And all that for what? Losing 0.1% of their data because of people deleting their account? Not worth it IMO.
- TheSpiceIsLife 9y ago
  In which event Huge Company finds the lowest level employee they can reasonably pin the blame on.
  - isostatic 9y ago
    But they still get fined 4% of their global revenue. A few $1.5bn fines and they'll learn how to delete.
    - 9y ago

thomed 9y ago

There’s a bunch of cases where a business should not delete data even if requested by a user; the biggie is crime/fraud prevention. However, if that data was later disclosed in a breach the company would be subject to penalties. The request for removal does count as rescinding consent, so you would no longer be able to do anything that required consent anyhow. Data could be thought of as radioactive so long as it has a unique identifier. If you can aggregate your fraud detection data in some way to remove the pseudonymous/personal identifiers then you should. If you can’t, then your usecase needs to justify the risk of keeping that radioactive material around. Watch out that your aggregates can’t be reverse engineered though. There’s a reasonableness test around how easy it would be to recompile a users profile etc. As technology advances things that were once unreasonable become reasonable think md5). I find it helpful to think of reasonableness being connected to the best 10 people you recently interviewed, or the actions of any competitor in the space. If a prosecutor can point to the competitor and ask why you didn’t do what they did, you need a very good reason to pass reasonableness.

asfdsfggtfd 9y ago

Yes.