7 ms·

I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at co

by lmkg 9y ago

I get the impression the GDPR expects you to not keep data around forever, as a general best practice. When you collect data, you have to tell your users at collection what your retention policy is (this is part of Right to Transparency). So, right there, you should probably have a retention policy, and "forever, always" isn't really a well-thought-out policy. The Right to Erasure is not as far-reaching as some people seem to think it is. If the Legal Basis of the data collection is Consent, then that consent is revocable and processing (including storage) pretty much has to end as soon as consent is revoked. But if the Legal Basis of collecting the data is something else, and I really feel like 90% of the time in practice it's going to be Legitimate Interest, then the Data Controller gets to balance their own needs against the rights of the Data Subject when handling a Right to Erasure or Right to Object request. And you can probably make a good argument that you don't need to modify back-ups. Your argument is stronger if a) your restore-from-back-up procedure can ignore or delete the user's data during/after restore b) your data retention policy eventually deletes the back-up.

jimktrains2 9y ago
I do I remove data in a WORM store?
- llukas 9y ago
  Encrypt data with per-user key. Drop key.
  - jimktrains2 9y ago
    So, now I can't run analysis of my logs because they're encrypted? Also, that data is still associated with the user. Is it to the letter of the law to keep it, even if it's unreadable?
    - freeone3000 9y ago
      I think you're starting to get the point of the GDPR, yes.
      - jimktrains2 9y ago
        The point of the gdpr is that I can't analyze past shipping costs? To optimize how I ship in the future? Also, how does this mesh with pci retention rules. (Yes, they are not law, but it's still an awkward place to be.)
        guitarbill 9y ago
        Ah yes, somebody being overly pedantic and trying to come up with examples to spread FUD. You couldn't possibly anonymize the data and then do the analytics, unheard of.
        jimktrains2 9y ago
        You're assuming that I knew I wanted to do said analysis, or that I would never want to go back to an order's record for more information. (What was ordered, or perhaps the US county someone is in that I need to figure out from the shipping address.) It's not that the analysis can't be done anonymously, but to do so requires foreknowledge of everything you would like to analyze.
        scaryclam 9y ago
        You can most certainly do that...Unless you've been incompetant with your data organisation and scattered PII where it really has no business being. In which case, how about sorting out your poor data practices before worrying about how you can optimise your shipping costs?
        jimktrains2 9y ago
        Not pii, but personal data, which is more broadly defined in the gdpr than pii is. Second, I think you're missing the context here. If I need to encryption each log entry that pertains to a user, even if it doesn't contain pii, then adhoc analysis is nearly impossible to do.
- tscs37 9y ago
  Is it truly a WORM store that cannot delete any data ever never? If so, you'll need to encrypt the data in a way that allows you to make records inaccessible. If the WORM store rotates out old data (webserver logs, tape backups with retention and rotation, etc.) then you simply inform the user of that and that's it.
  - jimktrains2 9y ago
    > If the WORM store rotates out old data (webserver logs, tape backups with retention and rotation, etc.) then you simply inform the user of that and that's it. Can you point me to where that's allowed? What if retention is reasonably long (a year)? or not (10 years)? > s it truly a WORM store that cannot delete any data ever never? If so, you'll need to encrypt the data in a way that allows you to make records inaccessible. So now I can't perform impromptu analysis of my own data in any computationally easy way? Security analysis? Analyzing shipping information to optimize in the future?
    - tscs37 9y ago
      Acronis, a german corporation, is implementing the GDPR too [0] and they recommend that if possible, you split backups per customer, if that is not practical atleast do your best to protect the data and don't keep it for unnecessary time frames. You should have a retention policy and encrypt your backups. [0]: https://www.acronis.com/en-us/blog/posts/backups-and-gdpr-right-be-forgotten-recommendations https://www.acronis.com/en-us/blog/posts/backups-and-gdpr-ri... [A0]: http://www.gdprarticles.com/gdpr-articles/data-subject-rights/gdpr-right-to-be-forgotten-include-backups/ http://www.gdprarticles.com/gdpr-articles/data-subject-right... [A1]: GDPR Art. 5 §1 a, b, c and f, §2 [A2]: GDPR Art. 17 §1 b and c, §3 b and e >So now I can't perform impromptu analysis of my own data in any computationally easy way? Security analysis? Analyzing shipping information to optimize in the future? Any analysis will have to be done in a way to make sure you're not exceeding the bounds of network security or you're outside legitimate interest. Analyzing shipping information is the same, as long as you do everything to make sure the data is pseudonimized or not otherwise in risk of leaking personal data, it's fine or alternatively you ask customers about it. >What if retention is reasonably long (a year)? or not (10 years)? Use your own judgement of what is reasonable, worst case you get a letter from the EU asking you to reduce the retention timeframe as long as you made an actual effort to implement the regulation.

by lmkg 9y ago

jimktrains2 9y ago

I do I remove data in a WORM store?

llukas 9y ago
Encrypt data with per-user key. Drop key.
- jimktrains2 9y ago
  So, now I can't run analysis of my logs because they're encrypted? Also, that data is still associated with the user. Is it to the letter of the law to keep it, even if it's unreadable?
  - freeone3000 9y ago
    I think you're starting to get the point of the GDPR, yes.
    - jimktrains2 9y ago
      The point of the gdpr is that I can't analyze past shipping costs? To optimize how I ship in the future? Also, how does this mesh with pci retention rules. (Yes, they are not law, but it's still an awkward place to be.)
      - guitarbill 9y ago
        Ah yes, somebody being overly pedantic and trying to come up with examples to spread FUD. You couldn't possibly anonymize the data and then do the analytics, unheard of.
        jimktrains2 9y ago
        You're assuming that I knew I wanted to do said analysis, or that I would never want to go back to an order's record for more information. (What was ordered, or perhaps the US county someone is in that I need to figure out from the shipping address.) It's not that the analysis can't be done anonymously, but to do so requires foreknowledge of everything you would like to analyze.
      - scaryclam 9y ago
        You can most certainly do that...Unless you've been incompetant with your data organisation and scattered PII where it really has no business being. In which case, how about sorting out your poor data practices before worrying about how you can optimise your shipping costs?
        jimktrains2 9y ago
        Not pii, but personal data, which is more broadly defined in the gdpr than pii is. Second, I think you're missing the context here. If I need to encryption each log entry that pertains to a user, even if it doesn't contain pii, then adhoc analysis is nearly impossible to do.
tscs37 9y ago
Is it truly a WORM store that cannot delete any data ever never? If so, you'll need to encrypt the data in a way that allows you to make records inaccessible. If the WORM store rotates out old data (webserver logs, tape backups with retention and rotation, etc.) then you simply inform the user of that and that's it.
- jimktrains2 9y ago
  > If the WORM store rotates out old data (webserver logs, tape backups with retention and rotation, etc.) then you simply inform the user of that and that's it. Can you point me to where that's allowed? What if retention is reasonably long (a year)? or not (10 years)? > s it truly a WORM store that cannot delete any data ever never? If so, you'll need to encrypt the data in a way that allows you to make records inaccessible. So now I can't perform impromptu analysis of my own data in any computationally easy way? Security analysis? Analyzing shipping information to optimize in the future?
  - tscs37 9y ago
    Acronis, a german corporation, is implementing the GDPR too [0] and they recommend that if possible, you split backups per customer, if that is not practical atleast do your best to protect the data and don't keep it for unnecessary time frames. You should have a retention policy and encrypt your backups. [0]: https://www.acronis.com/en-us/blog/posts/backups-and-gdpr-right-be-forgotten-recommendations https://www.acronis.com/en-us/blog/posts/backups-and-gdpr-ri... [A0]: http://www.gdprarticles.com/gdpr-articles/data-subject-rights/gdpr-right-to-be-forgotten-include-backups/ http://www.gdprarticles.com/gdpr-articles/data-subject-right... [A1]: GDPR Art. 5 §1 a, b, c and f, §2 [A2]: GDPR Art. 17 §1 b and c, §3 b and e >So now I can't perform impromptu analysis of my own data in any computationally easy way? Security analysis? Analyzing shipping information to optimize in the future? Any analysis will have to be done in a way to make sure you're not exceeding the bounds of network security or you're outside legitimate interest. Analyzing shipping information is the same, as long as you do everything to make sure the data is pseudonimized or not otherwise in risk of leaking personal data, it's fine or alternatively you ask customers about it. >What if retention is reasonably long (a year)? or not (10 years)? Use your own judgement of what is reasonable, worst case you get a letter from the EU asking you to reduce the retention timeframe as long as you made an actual effort to implement the regulation.