4 ms·

>You don't have to implement any new features to comply with the GDPR. How do you deal with user requests? You need at least somehow be able to gather the data

>You don't have to implement any new features to comply with the GDPR. How do you deal with user requests? You need at least somehow be able to gather the data, pack it into an user underdstandable format, and delete database entries, also from your backups.

ahartman00 9y ago
/export?userId=x (make sure to validate they are logged in) gather data: select * from every table that has userId pack it into understandable format: every language i have used makes json, xml, csv pretty darn easy delete: delete from.... backups: i am surprised your hobby project takes backups. perhaps have a table with userIds that were deleted, and when you make your new backup, remove all their data?
- jimktrains2 9y ago
  > delete: delete from.... Ah yes, and then all of my data has holes in it that I need to deal with. "Hmm, we only have 5 orders for this, but we're missing 6". "hmmm, we charged this credit card, but there's no order for it and I'm not sure if we ever shipped anything?" "hmmm, how do I delete this tracking number from the postal systems' records?"
  - esarbe 9y ago
    Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must.
    - jimktrains2 9y ago
      > Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must. Will regulators agree with what I "must" keep?
  - ahartman00 9y ago
    I thought we were talking about hobby projects here? If you are shipping things, collecting payment info, you should be taking things seriously.
    - Karunamon 9y ago
      Since when does selling things exclude something from being a hobby?
      - nfoz 9y ago
        hmmm.. if we're going to draw a line between "hobby" and "profession", then that's perhaps the most obvious way to do it.
      - dwheeler 9y ago
        Etsy https://www.etsy.com/ https://www.etsy.com/ is full of shops of people who create things as a hobby, but do try to sell things. There are many hobbyist creators who make a few things and try to sell some of them, at least to recoup costs and maybe even earn a little money. In many cases I suspect they earn about $0.001/hour. As a business, it's terrible; as a hobby, many enjoy it. I think "earning a competitive wage" is a reasonable cutoff for at least being on the road to a "real" business.
icedchai 9y ago
I suspect most people just ignore the backup part. Out of sight, out of mind...
GordonS 9y ago
If you're a small business, you are likely to receive a very small number of such requests, if indeed you receive any at all. For most small businesses, someone would simply do a manual extract/delete of the data if it was ever requested. Regarding backups, realistically you are not going to be required to delete from them as it's completely impractical to delete a single user's data from backup. You just need to be straight with your users - tell them that their data will be removed from your live system immediately, but that some data will remain in archive, securely encrypted, until the end of your defined retention period.

ahartman00 9y ago

/export?userId=x (make sure to validate they are logged in) gather data: select * from every table that has userId pack it into understandable format: every language i have used makes json, xml, csv pretty darn easy delete: delete from.... backups: i am surprised your hobby project takes backups. perhaps have a table with userIds that were deleted, and when you make your new backup, remove all their data?

jimktrains2 9y ago
> delete: delete from.... Ah yes, and then all of my data has holes in it that I need to deal with. "Hmm, we only have 5 orders for this, but we're missing 6". "hmmm, we charged this credit card, but there's no order for it and I'm not sure if we ever shipped anything?" "hmmm, how do I delete this tracking number from the postal systems' records?"
- esarbe 9y ago
  Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must.
  - jimktrains2 9y ago
    > Then you have a legitimate reason for keeping some of the data (book keeping, shipping) and not for others. Delete the data you can, keep what you must. Will regulators agree with what I "must" keep?
- ahartman00 9y ago
  I thought we were talking about hobby projects here? If you are shipping things, collecting payment info, you should be taking things seriously.
  - Karunamon 9y ago
    Since when does selling things exclude something from being a hobby?
    - nfoz 9y ago
      hmmm.. if we're going to draw a line between "hobby" and "profession", then that's perhaps the most obvious way to do it.
    - dwheeler 9y ago
      Etsy https://www.etsy.com/ https://www.etsy.com/ is full of shops of people who create things as a hobby, but do try to sell things. There are many hobbyist creators who make a few things and try to sell some of them, at least to recoup costs and maybe even earn a little money. In many cases I suspect they earn about $0.001/hour. As a business, it's terrible; as a hobby, many enjoy it. I think "earning a competitive wage" is a reasonable cutoff for at least being on the road to a "real" business.

icedchai 9y ago

I suspect most people just ignore the backup part. Out of sight, out of mind...

GordonS 9y ago

If you're a small business, you are likely to receive a very small number of such requests, if indeed you receive any at all. For most small businesses, someone would simply do a manual extract/delete of the data if it was ever requested. Regarding backups, realistically you are not going to be required to delete from them as it's completely impractical to delete a single user's data from backup. You just need to be straight with your users - tell them that their data will be removed from your live system immediately, but that some data will remain in archive, securely encrypted, until the end of your defined retention period.