3 ms·

The Right to Erasure is not absolute. A Right to Erasure request can be denied if you can describe an "Overriding Legitimate Interest." This has to be stronger

by lmkg 8y ago

The Right to Erasure is not absolute. A Right to Erasure request can be denied if you can describe an "Overriding Legitimate Interest." This has to be stronger than a regular legitimate interest that enables processing in the first place, but it's possible. The specifics will definitely require a lawyer, but I think it's possible to describe an overriding legitimate interest that allows you to retain message contents. Denying a request is not a simple yes/no. You can delete some data but not others, or delete data under certain conditions but not others. The principle of Data Minimization still applies to your overriding legitimate interest: only retain the data that is strictly necessary for that specific interest, which is likely less than the original data necessary. Probably the trickiest issue is going to be "what if the user sent a message that contains PII?"

nodesocket 8y ago
Does the Right To Erase apply to archived backups? I.E. we delete an account, but it still exists in database dumps backed up to S3.
- ldjb 8y ago
  The GDPR applies to all personal data you hold, even archived data. And therefore any associated rights apply to all data you hold, too. Of course, you might have an Overriding Legitimate Interest for that, too. For example, you might be required by law to retain some customer data. And therefore you might be in a position to refuse to erase certain archived data. But otherwise, there certainly could be situations where you would be required to erase archived data.
- repolfx 8y ago
  Nobody knows. Lawyers seem to split 50/50 on the issue, like everything else GDPR related. I think even asking questions like this is missing the point by now. See the discussion above. The GDPR doesn't say if backups are OK or for how long. They might be or might not be depending on whether a random EU official believes your justification is "legitimate". In other words, stay in the Commission's good books and you'll be fine. Take a position the Commission doesn't like and suddenly your backups might not be so legitimate after all.

by lmkg 8y ago

nodesocket 8y ago

Does the Right To Erase apply to archived backups? I.E. we delete an account, but it still exists in database dumps backed up to S3.

ldjb 8y ago
The GDPR applies to all personal data you hold, even archived data. And therefore any associated rights apply to all data you hold, too. Of course, you might have an Overriding Legitimate Interest for that, too. For example, you might be required by law to retain some customer data. And therefore you might be in a position to refuse to erase certain archived data. But otherwise, there certainly could be situations where you would be required to erase archived data.
repolfx 8y ago
Nobody knows. Lawyers seem to split 50/50 on the issue, like everything else GDPR related. I think even asking questions like this is missing the point by now. See the discussion above. The GDPR doesn't say if backups are OK or for how long. They might be or might not be depending on whether a random EU official believes your justification is "legitimate". In other words, stay in the Commission's good books and you'll be fine. Take a position the Commission doesn't like and suddenly your backups might not be so legitimate after all.