5 ms·

Do you know of a good place to read about the GDPR and backups? My concern has been the account deletion provision. Does the GDPR expect us to be able to go ba

Do you know of a good place to read about the GDPR and backups? My concern has been the account deletion provision. Does the GDPR expect us to be able to go back and modify past backups? Years-old tape archives?

jopsen 9y ago
Good question.. I would guess there is no requirement data is wiped. Your file system doesn't wipe data, it just marks it as deleted. At some point it's a technicality, the important part is that you stop using the data. I suspect intent matters more than technicality.
lmkg 9y ago
I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at collection what your retention policy is (this is part of Right to Transparency). So, right there, you should probably have a retention policy, and "forever, always" isn't really a well-thought-out policy. The Right to Erasure is not as far-reaching as some people seem to think it is. If the Legal Basis of the data collection is Consent, then that consent is revocable and processing (including storage) pretty much has to end as soon as consent is revoked. But if the Legal Basis of collecting the data is something else, and I really feel like 90% of the time in practice it's going to be Legitimate Interest, then the Data Controller gets to balance their own needs against the rights of the Data Subject when handling a Right to Erasure or Right to Object request. And you can probably make a good argument that you don't need to modify back-ups. Your argument is stronger if a) your restore-from-back-up procedure can ignore or delete the user's data during/after restore b) your data retention policy eventually deletes the back-up.
- jimktrains2 9y ago
  I do I remove data in a WORM store?
  - llukas 9y ago
    Encrypt data with per-user key. Drop key.
    - jimktrains2 9y ago
      So, now I can't run analysis of my logs because they're encrypted? Also, that data is still associated with the user. Is it to the letter of the law to keep it, even if it's unreadable?
      - freeone3000 9y ago
        I think you're starting to get the point of the GDPR, yes.
        jimktrains2 9y ago
        The point of the gdpr is that I can't analyze past shipping costs? To optimize how I ship in the future? Also, how does this mesh with pci retention rules. (Yes, they are not law, but it's still an awkward place to be.)
        guitarbill 9y ago
        Ah yes, somebody being overly pedantic and trying to come up with examples to spread FUD. You couldn't possibly anonymize the data and then do the analytics, unheard of.
        jimktrains2 9y ago
        You're assuming that I knew I wanted to do said analysis, or that I would never want to go back to an order's record for more information. (What was ordered, or perhaps the US county someone is in that I need to figure out from the shipping address.) It's not that the analysis can't be done anonymously, but to do so requires foreknowledge of everything you would like to analyze.
manigandham 9y ago
Start by reading the actual regulation, provided here in a easy online format without the extraneous formatting: https://gdpr-info.eu/ https://gdpr-info.eu/ If you want a shortcut, you can try the EnterpriseReady site which has a great overview specific to SaaS companies: https://www.enterpriseready.io/gdpr/ https://www.enterpriseready.io/gdpr/ As always though, your best resource is to talk to a lawyer. Do not trust any internet comments about legal decisions for your business.
cdjk 9y ago
A reasonable approach that we're following is to have a documented backup retention policy and a procedure to re-delete data for any users who have asked to be deleted when those backups are restored. That retention policy can be longer than 30 days as it's impossible or infeasible to delete individual user data from all the backups. One easy way to do this is with an expiration policy on s3 objects. You need to have an independent backup of those deletion requests though. If you have a years-old tape archive you probably have a massive legal team who is much better equipped to answer this question.
hjnilsson 9y ago
There is no need to go back and modify backups. You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. Then you delete the backups and records of deletion (or the tables in it that contain personally-identified information) after X days.
- jimktrains2 9y ago
  > You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. All of which requires a good deal of development work.

jopsen 9y ago

Good question.. I would guess there is no requirement data is wiped. Your file system doesn't wipe data, it just marks it as deleted. At some point it's a technicality, the important part is that you stop using the data. I suspect intent matters more than technicality.

lmkg 9y ago

I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at collection what your retention policy is (this is part of Right to Transparency). So, right there, you should probably have a retention policy, and "forever, always" isn't really a well-thought-out policy. The Right to Erasure is not as far-reaching as some people seem to think it is. If the Legal Basis of the data collection is Consent, then that consent is revocable and processing (including storage) pretty much has to end as soon as consent is revoked. But if the Legal Basis of collecting the data is something else, and I really feel like 90% of the time in practice it's going to be Legitimate Interest, then the Data Controller gets to balance their own needs against the rights of the Data Subject when handling a Right to Erasure or Right to Object request. And you can probably make a good argument that you don't need to modify back-ups. Your argument is stronger if a) your restore-from-back-up procedure can ignore or delete the user's data during/after restore b) your data retention policy eventually deletes the back-up.

jimktrains2 9y ago
I do I remove data in a WORM store?
- llukas 9y ago
  Encrypt data with per-user key. Drop key.
  - jimktrains2 9y ago
    So, now I can't run analysis of my logs because they're encrypted? Also, that data is still associated with the user. Is it to the letter of the law to keep it, even if it's unreadable?
    - freeone3000 9y ago
      I think you're starting to get the point of the GDPR, yes.
      - jimktrains2 9y ago
        The point of the gdpr is that I can't analyze past shipping costs? To optimize how I ship in the future? Also, how does this mesh with pci retention rules. (Yes, they are not law, but it's still an awkward place to be.)
        guitarbill 9y ago
        Ah yes, somebody being overly pedantic and trying to come up with examples to spread FUD. You couldn't possibly anonymize the data and then do the analytics, unheard of.
        jimktrains2 9y ago
        You're assuming that I knew I wanted to do said analysis, or that I would never want to go back to an order's record for more information. (What was ordered, or perhaps the US county someone is in that I need to figure out from the shipping address.) It's not that the analysis can't be done anonymously, but to do so requires foreknowledge of everything you would like to analyze.

manigandham 9y ago

Start by reading the actual regulation, provided here in a easy online format without the extraneous formatting: https://gdpr-info.eu/ https://gdpr-info.eu/ If you want a shortcut, you can try the EnterpriseReady site which has a great overview specific to SaaS companies: https://www.enterpriseready.io/gdpr/ https://www.enterpriseready.io/gdpr/ As always though, your best resource is to talk to a lawyer. Do not trust any internet comments about legal decisions for your business.

cdjk 9y ago

A reasonable approach that we're following is to have a documented backup retention policy and a procedure to re-delete data for any users who have asked to be deleted when those backups are restored. That retention policy can be longer than 30 days as it's impossible or infeasible to delete individual user data from all the backups. One easy way to do this is with an expiration policy on s3 objects. You need to have an independent backup of those deletion requests though. If you have a years-old tape archive you probably have a massive legal team who is much better equipped to answer this question.

hjnilsson 9y ago

There is no need to go back and modify backups. You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. Then you delete the backups and records of deletion (or the tables in it that contain personally-identified information) after X days.

jimktrains2 9y ago
> You decide on a timeframe for deletion of backups (ie. X days). You keep a record of deletion requests you receive for X days. If you need to restore to a backup, you delete data again for the users that requested it. All of which requires a good deal of development work.