5 ms·

Are the messages stored on your own servers or on the users' own devices? If they're on your servers, it should not be necessary to keep multiple copies of the

• webish 8y ago
  They are stored on our servers. The problem is, not all users will want the message deleted just because one of the recipients does. This creates a conflict with the GDPRs right to have information deleted. Recipient A might want the message deleted but recipients B and C may not
  • ldjb 8y ago
    Suppose you have a Message_Recipients table in your database with the following columns: message_id, recipient_user_id, deleted. If a particular message has three recipients, then it will have three entries in this table. The 'deleted' column is a boolean that is initially false. But when a recipient deletes their copy, 'deleted' becomes true and the message will be hidden in the UI for that recipient only. If it's the sender who is deleting the message, then just delete it in the Messages table, and no one else will be able to view it.
    • webish 8y ago
      Our current implementation is similar to this, bit if the sender deletes a message, don't the recipients have a right to retain a message that was sent to them? For their own records I mean. This is what's causing the difficulty. A sender's right to delete the message vs a recipient's right to keep copies of messages sent to them.
      • lapnitnelav 8y ago
        You might need to provide more context here. Depending on whether it's targeting businesses or consumers, expectations and needs are different.
      • jdietrich 8y ago
        >don't the recipients have a right to retain a message that was sent to them? No. There is no "right to retention" in the GDPR. Users have the right to access any data you hold that relates to them (with some exceptions), but you are under no obligation to retain data. GDPR requires you to do the exact opposite - delete (or thoroughly anonymise) data as soon as possible. Art.5(1)(e) says "Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". If you're aiming for maximum GDPR compliance, it would be sensible to delete the messages from your server as soon as they have been delivered to the recipients. You're a messaging service, not an archival service; storing the messaging data or metadata indefinitely is contrary to the principles of the GDPR and exposes you to liability if that data is ever leaked. I'd also question why you need plaintext access to user messages in the first place. End-to-end encryption protects you and your users. If you can't access the data, you can't inadvertently breach the GDPR. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
        • jdietrich 8y ago
          Would any of the people who downvoted my comment like to explain their point of disagreement? If you believe my statement to be factually wrong, it would be more useful to correct it rather than simply downvoting it.
        • x0x0 8y ago
          You probably need plain-text access so that messages can live on the server rather than the device. It is a common desire for users to (1) use more than one device; (2) sign in a new device and have access to message history; (3) message search to work. You can probably put these together in an end-to-end encrypted system -- can apple access old messages on a new device? -- but it's very complex.
  • codedokode 8y ago
    What if the user posts something that violates US laws, for example, terrorism-related content, secret information related to national security or child porn? What if you receive a court order to remove the message? What will you do? You just should do the same thing with GDPR requests.