4 ms·

It’s the implementation that is difficult. For example, if someone wants their data deleted I need to go delete all of the email correspondence, I need to delet

It’s the implementation that is difficult. For example, if someone wants their data deleted I need to go delete all of the email correspondence, I need to delete them from applications like Google Analytics. If I follow them on Twitter or interacted with the on Twitter I need to delete those posts. Oh and then there are backup archives that I now need to scrub. The point being is a lot of data is not well assembled and cleaned for deletion which is why data analytics on your existing data is so hard in the first place!

Matticus_Rex 8y ago
And the difficulty can rise exponentially if you have a giant stack that wasn't designed with GDPR in mind (though it may be totally benign in its risk towards data subjects) and which cannot be easily disentangled to comply with some of these requirements.
- linker3000 8y ago
  Opinion on the matter: "The GDPR however does make a small concession to companies in this case: the steps they need to take in this direction are limited to the available technology and the cost of its implementation. Organizations must take reasonable measures to ensure processors are aware of the request, but will not be at fault if the data is not completely erased by third parties." https://www.endpointprotector.com/blog/gdpr-essentials-the-right-to-erasure-who-can-request-it-and-how-is-it-applied/ https://www.endpointprotector.com/blog/gdpr-essentials-the-r...
  - Matticus_Rex 8y ago
    The vaguery there is the problem. I know how I would decide if it were up to me, but if a supervisory authority comes calling, that's just my argument, and they almost certainly have a preset opinion about what is reasonable.
linker3000 8y ago
It's unlikely you will need to scrub backup archives: http://www.gdprarticles.com/gdpr-articles/data-subject-rights/gdpr-right-to-be-forgotten-include-backups/ http://www.gdprarticles.com/gdpr-articles/data-subject-right...
ec109685 8y ago
This more evidence that a hard consent is legal (from a conversation we had a few weeks ago on HN): https://twitter.com/maxschrems/status/998681336427827201?s=21 https://twitter.com/maxschrems/status/998681336427827201?s=2...

Matticus_Rex 8y ago

And the difficulty can rise exponentially if you have a giant stack that wasn't designed with GDPR in mind (though it may be totally benign in its risk towards data subjects) and which cannot be easily disentangled to comply with some of these requirements.

linker3000 8y ago
Opinion on the matter: "The GDPR however does make a small concession to companies in this case: the steps they need to take in this direction are limited to the available technology and the cost of its implementation. Organizations must take reasonable measures to ensure processors are aware of the request, but will not be at fault if the data is not completely erased by third parties." https://www.endpointprotector.com/blog/gdpr-essentials-the-right-to-erasure-who-can-request-it-and-how-is-it-applied/ https://www.endpointprotector.com/blog/gdpr-essentials-the-r...
- Matticus_Rex 8y ago
  The vaguery there is the problem. I know how I would decide if it were up to me, but if a supervisory authority comes calling, that's just my argument, and they almost certainly have a preset opinion about what is reasonable.

linker3000 8y ago

It's unlikely you will need to scrub backup archives: http://www.gdprarticles.com/gdpr-articles/data-subject-rights/gdpr-right-to-be-forgotten-include-backups/ http://www.gdprarticles.com/gdpr-articles/data-subject-right...

ec109685 8y ago

This more evidence that a hard consent is legal (from a conversation we had a few weeks ago on HN): https://twitter.com/maxschrems/status/998681336427827201?s=21 https://twitter.com/maxschrems/status/998681336427827201?s=2...