3 ms·

Art.5(1)(e) says "Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which

Art.5(1)(e) says "Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". The messages themselves constitute personal data, as defined in art.4(1). Data doesn't need to be tagged with someone's name, address and social security number to be personal data - if you could even hypothetically identify someone based on that data, then it's personal data. Even if the users of this service never divulge any personal information about themselves in the content of their messages under any circumstances, they could still be identified by stylometry. There's a reasonable argument that retention of old messages is a necessary feature of the product, but I'd be strongly inclined to delete everything from the servers as soon as it's delivered. Old messages stored on the user's devices aren't your problem as long as your involvement in the processing of those messages was lawful. I'd also be strongly inclined to implement end-to-end encryption unless there's an overwhelming reason not to, because it adds a valuable layer of protection for both you and your users. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/

everdev 8y ago
I would follow other prominent players in the space. When I delete my tweets, are those retweets and replies also deleted? When I delete my FB or Whatsapp account, are my messages deleted from recipients accounts? As a lean startup, I wouldn't pay my own lawyer to figure out what hundreds of well paid lawyers have already decided. You could write tech support for these companies and ask exactly how their GDPR compliance works. I'm sure they'll be happy if not legally obligated to tell you.
- jdietrich 8y ago
  >I would follow other prominent players in the space. Facebook can afford to play fast-and-loose with the rules. They have an army of lawyers waiting to contest any ruling from a supervisory authority. They have an army of developers ready to redesign their product if they're ordered to do so. They have an army of DBAs and CSRs to manage deletion requests and subject access requests. If you're running a startup that collects and processes lots of personal data and your resources are rather more limited than Facebook, it's sensible to interpret the GDPR cautiously. The more data you collect and store, the greater your potential liabilities. We're habituated to hoarding personal data, because the cost of storage is effectively nil and it might be useful at some point in the future. GDPR makes Schneier's argument that "data is a toxic asset" into a business reality. https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
- ldjb 8y ago
  When you delete your tweets, then yes, assuming people retweeted using the Retweet button, those retweets are also deleted. Replies are not deleted because those belong to the senders, not you. As for Facebook, it is true that deleting your account does not delete your messages. That's something they have been criticised for. However, I believe deleting your messages does result in recipients being unable to access them (except from cache, of course).

everdev 8y ago

I would follow other prominent players in the space. When I delete my tweets, are those retweets and replies also deleted? When I delete my FB or Whatsapp account, are my messages deleted from recipients accounts? As a lean startup, I wouldn't pay my own lawyer to figure out what hundreds of well paid lawyers have already decided. You could write tech support for these companies and ask exactly how their GDPR compliance works. I'm sure they'll be happy if not legally obligated to tell you.

jdietrich 8y ago
>I would follow other prominent players in the space. Facebook can afford to play fast-and-loose with the rules. They have an army of lawyers waiting to contest any ruling from a supervisory authority. They have an army of developers ready to redesign their product if they're ordered to do so. They have an army of DBAs and CSRs to manage deletion requests and subject access requests. If you're running a startup that collects and processes lots of personal data and your resources are rather more limited than Facebook, it's sensible to interpret the GDPR cautiously. The more data you collect and store, the greater your potential liabilities. We're habituated to hoarding personal data, because the cost of storage is effectively nil and it might be useful at some point in the future. GDPR makes Schneier's argument that "data is a toxic asset" into a business reality. https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
ldjb 8y ago
When you delete your tweets, then yes, assuming people retweeted using the Retweet button, those retweets are also deleted. Replies are not deleted because those belong to the senders, not you. As for Facebook, it is true that deleting your account does not delete your messages. That's something they have been criticised for. However, I believe deleting your messages does result in recipients being unable to access them (except from cache, of course).