4 ms·

AFAIK GDPR mandates that deleted data is no longer processed (used for marketing, analyzed, etc). I don't remember it saying anything about the data "existing";

AFAIK GDPR mandates that deleted data is no longer processed (used for marketing, analyzed, etc). I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry.

metaobject 9y ago
Furthermore, I'd imagine that the host might be required to retain those records for law enforcement purposes (imagine if someone made death threats, etc and law enforcement requested those records for an investigation).
- zaarn 9y ago
  GDPR does have exceptions for legal compliance, yes. If someone does something illegal and they request deletions you can (IMO, not a lawyer) retain the records if you know there is an investigation or court case going or strongly suspect so or initiate it yourself.
  - asfdsfggtfd 9y ago
    You may even be able to keep comments/posts for longer for general compliance. You will need an audit explaining why and to be prepared to defend it. You won't be able to use such data for analytics. This is based on my personal layman's understanding. I am NOT a lawyer. I am NOT your lawyer. If you need legal advice consult a competent lawyer in your jurisdiction.
  - HenryBemis 9y ago
    Legal/Regulatory compliance is not for Facebook or Amazon. It is to prevent people going to their Bank, where they have a credit card or a consumer loan, or a mortgage, and say "can I please be forgotten/be wiped from your systems - oh and the loan too!".
microcolonel 9y ago
> I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry. You just store the keys separately, assuming one-way encryption (losing the key) counts as deletion.
talaketu 9y ago
IANAL - no idea what "erasure" as in the "Right to erasure" means http://www.privacy-regulation.eu/en/article-17-right-to-erasure-%27right-to-be-forgotten%27-GDPR.htm http://www.privacy-regulation.eu/en/article-17-right-to-eras... But... if deleted data is no longer processed, does that mean it can not longer be used for targeting etc?
asfdsfggtfd 9y ago
It means deleted as in gone. Your backups should be cycled after a few months and the deleted data will eventually not be present in any backups.

metaobject 9y ago

Furthermore, I'd imagine that the host might be required to retain those records for law enforcement purposes (imagine if someone made death threats, etc and law enforcement requested those records for an investigation).

zaarn 9y ago
GDPR does have exceptions for legal compliance, yes. If someone does something illegal and they request deletions you can (IMO, not a lawyer) retain the records if you know there is an investigation or court case going or strongly suspect so or initiate it yourself.
- asfdsfggtfd 9y ago
  You may even be able to keep comments/posts for longer for general compliance. You will need an audit explaining why and to be prepared to defend it. You won't be able to use such data for analytics. This is based on my personal layman's understanding. I am NOT a lawyer. I am NOT your lawyer. If you need legal advice consult a competent lawyer in your jurisdiction.
- HenryBemis 9y ago
  Legal/Regulatory compliance is not for Facebook or Amazon. It is to prevent people going to their Bank, where they have a credit card or a consumer loan, or a mortgage, and say "can I please be forgotten/be wiped from your systems - oh and the loan too!".

microcolonel 9y ago

> I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry. You just store the keys separately, assuming one-way encryption (losing the key) counts as deletion.

talaketu 9y ago

IANAL - no idea what "erasure" as in the "Right to erasure" means http://www.privacy-regulation.eu/en/article-17-right-to-erasure-%27right-to-be-forgotten%27-GDPR.htm http://www.privacy-regulation.eu/en/article-17-right-to-eras... But... if deleted data is no longer processed, does that mean it can not longer be used for targeting etc?

asfdsfggtfd 9y ago

It means deleted as in gone. Your backups should be cycled after a few months and the deleted data will eventually not be present in any backups.