6 ms·

> A suggestion from Michiel Rook’s blog is that maybe is enough to remove the data from the projections/read models, and there is no need to touch the data in t

by WA 9y ago

> A suggestion from Michiel Rook’s blog is that maybe is enough to remove the data from the projections/read models, and there is no need to touch the data in the event store. No. This is very easy. The right to be forgotten means: if I’m done with your web service and I want to have my account deleted, you have to delete everything you have on me in a reasonable timeframe and which is not required by you for other laws (such as keeping receipts of my purchases for 6-10 years). If someone can replay that log step by step (and I think this is the idea of Event Sourcing), and my data shows up in there for no particular reason, it’s illegal. There is no need for you to archive data, if I don’t want you to create that archive or if I want you to delete that archive. Also, if I haven’t used your web service after X years, you should send a friendly reminder that my account and all data will be erased soon. If I don’t reactivate, you should delete every information that helps you or anyone to identify me as a person. Edit: arguing with the purpose of “archiving” is exactly this fucked up weaseling around which companies do to circumvent the law. Take responsibility for your users data and delete everything after a while or on request.

havkom 9y ago
Yes. Forget about just not rendering the data in projections. Article 5.1e states: “Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed [...]” Article 5 contains concrete rules and also sets out the basic principles. In short, you must be able to remove all information that may enable you to “single out” an individual (a physical individual by eg name or an online identity such as a particular web visitor by eg a cookie id).
- Fiahil 9y ago
  So, if you're building your infrastructure in a way that you need to access a separate datastore to discover which individual is linked to which event in a stream. Then, leaving the stream of event as it is, but removing all referred keys in the joined datastore would be "GDPR-compliant"?
_betty_ 9y ago
Makes me wonder about block chain data that can't be deleted
- TeMPOraL 9y ago
  If you put PII on the blockchain then God have mercy on your soul when the regulators find out...
  - repsilat 9y ago
    Can a malicious actor put PII (or copyrighted/otherwise illegal works) onto a blockchain to "kill" it?
    - _betty_ 9y ago
      There's apparently all sorts of illegal stuff embedded in bitcoin metadata
      - SuddsMcDuff 9y ago
        An uncensorable, global, distributed data store opens up all kinds of possibilities for weaponizing data. If you're intending to blackmail* someone by threat of doxxing, threatening to put their information on the blockchain is much worse than simply putting it on pastebin. People have also attempted to use blockchain data for coercion. For example some folks were worried about the centralization of Bitcoin mining in China, so they posted information about Tiananmen Square on the blockchain, hoping the Chinese government would simply ban Bitcoin. *blockmailing them, if you will.
- PeterisP 9y ago
  That's quite simple - as a controller holding my data, you're responsible for safeguarding the data and fulfilling the requirements, so if putting that data on a public blockchain makes it impossible to do your duty, then you're not allowed to put that data on a public blockchain. If I put my data there, that's my problem, but you're not allowed to do that.
eksemplar 9y ago
It’s easy, but poses massive problems in the public sector or finance. Say you’re terrible at paying your dept, but manage to do so 10 years late. Now your transaction is complete and you have the right to be forgotten, but I wouldn’t want to ever lend you money again. How do I keep that record?
- number6 9y ago
  You take Art 6 (f) of the GDPR. You write down that your processing is necessary for the purposes of the legitimate interests pursued by you. E.g. I don't want to lend money to a you ever again. But to identify you and not mistake you for someone I need to keep information like Name, Passportnumber and a reason why I put you on the list in first place. Now you can keep these information.
  - icebraining 9y ago
    But the important point: you can only use that information for that purpose. No "oh well, now that we can keep it, let's use it for marketing and such".
    - number6 9y ago
      Good point! Looking at Recital 50 there may be possibility to use information for other than the original purpose if the new purpose is compatible. But another interesting thought: Can Marketing hold as a legitimate interest? Lets look at Recital 47: The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. Interseting finding you think. Reading this again the word may is striking. Ok this is not a Carte Blance. And since there is Recital 70 which states: "Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information." So where does this leave us: Yeah we can use Data for Marketing and it well may be a legitimate interest of a company. But we will have to inform the data subject that it can object the usage.
Vinnl 9y ago
Aren't there provisions for things like back-ups and other stuff that you can reasonably expect not to turn up later? I would think data in the event store but not in projections could be considered as such, to some extent.
- corobo 9y ago
  I should disclaim this with: I've only spoken to people who have looked into this. I can't guarantee it's correct, but it's the situation as I know it currently. It's also assuming cold backups that are not processed in any way that accesses the should-be-removed data You don't need to remove data from backups in realtime but you do need a system in place to re-delete data after a backup restore that previously had a removal request made against it. From what I've heard so far the best method is some form of GUID that means nothing when there's no data attached to it but can be used to identify user records that need removing if they re-appear during a backup restore Naturally, you'll want to make the please-delete-these-GUIDs table more redundant than the rest of what you've backed up
  - he0001 9y ago
    There’s no distinction between storage and backup. Most large backup companies are developing fixes for removing data in backups.
blowski 9y ago
Your right to be forgotten is balanced against a business’s right to make money, and society’s right to remember. I imagine that a court would consider a whole range of factors in weighing that balance. How much real harm was done to you? How expensive would it be for us to delete the data? What steps have we taken to protect your privacy? I highly doubt that the courts will see it as black and white as you suggest.
- Certhas 9y ago
  That is nonsense. The right to be forgotten is EU law, enacted by the EU parliament, enforceable by EU court. Article 17 of the GDPR. There is no "right to make money" or "right to remember" in this sense at all. You can argue that there is a public interest in allowing people to make money, and a public interest in remembering, but the place where these interests are weighed is in parliament. Not in courts.
  - blowski 9y ago
    > There is no ... "right to remember" To quote Article 17.3.d: > for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing In fact the whole of Article 17 contains exceptions to the right to be forgotten. Meanwhile Article 16 of the EU Charter of Fundamental Rights (enacted 2009) is the "right to do business", and some of it conflicts with GDPR. All legislation is interpreted by the courts. It's very rarely as simple as "the law says X, therefore you are guilty. Case closed." Instead, lawyers argue about conflicting legislation, and previous cases. A judge weighs all those arguments, and gives a decision, which then affects other future cases. I am not a lawyer, but I have spent quite a bit of time working with lawyers to comply with GDPR. What I have said here interprets their words.
    - Certhas 9y ago
      Yes, so there is no "right to remember" and the right to do business is not the "right to make money" doing business. So you're at the very least misquoting your lawyers. 17(3), and in more detail 89(1) closely circumscribes the scope of exceptions. Specifically in the context of the post you replied to: There is obviously no public interest exception that would allow you to keep the data around because a specific technical implementation becomes more convenient/cheaper if you do.
ryanmarsh 9y ago
Would it be sufficient to scrub the event log of PII so you don’t have to break as much of the object graph in the read model?

by WA 9y ago

havkom 9y ago

Yes. Forget about just not rendering the data in projections. Article 5.1e states: “Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed [...]” Article 5 contains concrete rules and also sets out the basic principles. In short, you must be able to remove all information that may enable you to “single out” an individual (a physical individual by eg name or an online identity such as a particular web visitor by eg a cookie id).

Fiahil 9y ago
So, if you're building your infrastructure in a way that you need to access a separate datastore to discover which individual is linked to which event in a stream. Then, leaving the stream of event as it is, but removing all referred keys in the joined datastore would be "GDPR-compliant"?

_betty_ 9y ago

Makes me wonder about block chain data that can't be deleted

TeMPOraL 9y ago
If you put PII on the blockchain then God have mercy on your soul when the regulators find out...
- repsilat 9y ago
  Can a malicious actor put PII (or copyrighted/otherwise illegal works) onto a blockchain to "kill" it?
  - _betty_ 9y ago
    There's apparently all sorts of illegal stuff embedded in bitcoin metadata
    - SuddsMcDuff 9y ago
      An uncensorable, global, distributed data store opens up all kinds of possibilities for weaponizing data. If you're intending to blackmail* someone by threat of doxxing, threatening to put their information on the blockchain is much worse than simply putting it on pastebin. People have also attempted to use blockchain data for coercion. For example some folks were worried about the centralization of Bitcoin mining in China, so they posted information about Tiananmen Square on the blockchain, hoping the Chinese government would simply ban Bitcoin. *blockmailing them, if you will.
PeterisP 9y ago
That's quite simple - as a controller holding my data, you're responsible for safeguarding the data and fulfilling the requirements, so if putting that data on a public blockchain makes it impossible to do your duty, then you're not allowed to put that data on a public blockchain. If I put my data there, that's my problem, but you're not allowed to do that.

eksemplar 9y ago

It’s easy, but poses massive problems in the public sector or finance. Say you’re terrible at paying your dept, but manage to do so 10 years late. Now your transaction is complete and you have the right to be forgotten, but I wouldn’t want to ever lend you money again. How do I keep that record?

number6 9y ago
You take Art 6 (f) of the GDPR. You write down that your processing is necessary for the purposes of the legitimate interests pursued by you. E.g. I don't want to lend money to a you ever again. But to identify you and not mistake you for someone I need to keep information like Name, Passportnumber and a reason why I put you on the list in first place. Now you can keep these information.
- icebraining 9y ago
  But the important point: you can only use that information for that purpose. No "oh well, now that we can keep it, let's use it for marketing and such".
  - number6 9y ago
    Good point! Looking at Recital 50 there may be possibility to use information for other than the original purpose if the new purpose is compatible. But another interesting thought: Can Marketing hold as a legitimate interest? Lets look at Recital 47: The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. Interseting finding you think. Reading this again the word may is striking. Ok this is not a Carte Blance. And since there is Recital 70 which states: "Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information." So where does this leave us: Yeah we can use Data for Marketing and it well may be a legitimate interest of a company. But we will have to inform the data subject that it can object the usage.

Vinnl 9y ago

Aren't there provisions for things like back-ups and other stuff that you can reasonably expect not to turn up later? I would think data in the event store but not in projections could be considered as such, to some extent.

corobo 9y ago
I should disclaim this with: I've only spoken to people who have looked into this. I can't guarantee it's correct, but it's the situation as I know it currently. It's also assuming cold backups that are not processed in any way that accesses the should-be-removed data You don't need to remove data from backups in realtime but you do need a system in place to re-delete data after a backup restore that previously had a removal request made against it. From what I've heard so far the best method is some form of GUID that means nothing when there's no data attached to it but can be used to identify user records that need removing if they re-appear during a backup restore Naturally, you'll want to make the please-delete-these-GUIDs table more redundant than the rest of what you've backed up
- he0001 9y ago
  There’s no distinction between storage and backup. Most large backup companies are developing fixes for removing data in backups.

blowski 9y ago

Your right to be forgotten is balanced against a business’s right to make money, and society’s right to remember. I imagine that a court would consider a whole range of factors in weighing that balance. How much real harm was done to you? How expensive would it be for us to delete the data? What steps have we taken to protect your privacy? I highly doubt that the courts will see it as black and white as you suggest.

Certhas 9y ago
That is nonsense. The right to be forgotten is EU law, enacted by the EU parliament, enforceable by EU court. Article 17 of the GDPR. There is no "right to make money" or "right to remember" in this sense at all. You can argue that there is a public interest in allowing people to make money, and a public interest in remembering, but the place where these interests are weighed is in parliament. Not in courts.
- blowski 9y ago
  > There is no ... "right to remember" To quote Article 17.3.d: > for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing In fact the whole of Article 17 contains exceptions to the right to be forgotten. Meanwhile Article 16 of the EU Charter of Fundamental Rights (enacted 2009) is the "right to do business", and some of it conflicts with GDPR. All legislation is interpreted by the courts. It's very rarely as simple as "the law says X, therefore you are guilty. Case closed." Instead, lawyers argue about conflicting legislation, and previous cases. A judge weighs all those arguments, and gives a decision, which then affects other future cases. I am not a lawyer, but I have spent quite a bit of time working with lawyers to comply with GDPR. What I have said here interprets their words.
  - Certhas 9y ago
    Yes, so there is no "right to remember" and the right to do business is not the "right to make money" doing business. So you're at the very least misquoting your lawyers. 17(3), and in more detail 89(1) closely circumscribes the scope of exceptions. Specifically in the context of the post you replied to: There is obviously no public interest exception that would allow you to keep the data around because a specific technical implementation becomes more convenient/cheaper if you do.

ryanmarsh 9y ago

Would it be sufficient to scrub the event log of PII so you don’t have to break as much of the object graph in the read model?