> Even centralized logs can have rotation and retention. That was a response to the comment about the default installs in most distros, not the ability of cen

> Even centralized logs can have rotation and retention. That was a response to the comment about the default installs in most distros, not the ability of centralized services to rotate logs. It was pedantic and I regret derailing the discussion with it. > The company will have to decide for themselves, primarly, if some interest is legitimate. Until a regulator comes and makes a separate decision, and you have to plead with them that you're not wrong even when they think you are. > If you are wrong in what you think is legitimate, you get a sternly worded letter from your favorite regulatory body asking you to fix it. From a regulatory body that has no real authority over me, except it might? I think my biggest issue is that I don't deem data a company has on me _my_ data or that they have to explain everything they do with _their_ data about me. I was never under the impression that it was my data, and in fact, I assume anything I put on a computer I don't control or have a paid, contractual agreement around is public. I fundamentally don't agree with or understand the premise that the situation is otherwise. (The biggest exception being that I do expect companies to honor their contractual obligations under their credit card processing agreements, but that's not really about _me_ or data about me.)