4 ms·

Not true.

by 4ndrewl 8y ago

Not true.

mc32 8y ago
Has that interpretation changed? I recall reading that in some circumstances it could. Or was that misinformation?
- Silhouette 8y ago
  No-one actually knows. What constitutes erasure and how to deal with all the edge cases around backups, archives, unstructured data and so on is one of the big ambiguities under GDPR, and one of the areas most in need of (but mostly lacking) actionable guidance from official sources.
  - pkaye 8y ago
    I'm surprised with the law being around for 2 years nobody has received the official guidance needed.
    - Silhouette 8y ago
      The law might have been around for 2 years, but in practice many smaller organisations didn't find out about it until a few months ago. Much of the official guidance is more recent even than that. And much of that guidance doesn't really help anyway, because it is often almost as vague and/or incomplete as the original regulations themselves. Questions about numerous everyday issues that will affect literally millions of businesses across the EU are still lacking useful answers.
dan-0 8y ago
> Not true. ... unless you plan to use the backups. Then you have to have another service that tracks entities to delete when a backup it's restored... and back that up separately.
- drtillberg 8y ago
  If you back up a list of things to delete is that GDPR compliant? Ponder.
  - dan-0 8y ago
    > If you back up a list of things to delete is that GDPR compliant? Ponder. There's little to ponder, that's why I mentioned "entities" rather than "user data." Use unique keys to reference the data rather than sensitive identifiers. The nontrivial part is storing your backup of entities to be deleted in a way that doesn't get destroyed at the same time as the event that forces you to revert to a backup. This now requires a separate storage, backup, and retrieval mechanism to maintain compliance.
    - erichocean 8y ago
      > Use unique keys to reference the data rather than sensitive identifiers. This is terrible advice. All identifiers are PII and covered by the GDPR, not just the "sensitive" ones.
      - jdietrich 8y ago
        The GDPR does not use the term "personally identifying information" anywhere in the text. Using that term suggests that you either haven't read the text or haven't understood it. "Personal data" (the term actually used in GDPR) means any information relating to an identified or identifiable natural person. The GDPR specifically states that the regulations do not apply to anonymous data. A list of unique keys marked "never restore this data from backups" is not personal data. The data associated with those identifiers is not personal data if it cannot be associated with an identifiable natural person. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/ Quantum has produced a very useful white paper on GDPR in relation to backup and archive systems. https://landing.quantum.com/GDPR_WP_0118_RP.html https://landing.quantum.com/GDPR_WP_0118_RP.html

Not true.

mc32 8y ago

Has that interpretation changed? I recall reading that in some circumstances it could. Or was that misinformation?

Silhouette 8y ago
No-one actually knows. What constitutes erasure and how to deal with all the edge cases around backups, archives, unstructured data and so on is one of the big ambiguities under GDPR, and one of the areas most in need of (but mostly lacking) actionable guidance from official sources.
- pkaye 8y ago
  I'm surprised with the law being around for 2 years nobody has received the official guidance needed.
  - Silhouette 8y ago
    The law might have been around for 2 years, but in practice many smaller organisations didn't find out about it until a few months ago. Much of the official guidance is more recent even than that. And much of that guidance doesn't really help anyway, because it is often almost as vague and/or incomplete as the original regulations themselves. Questions about numerous everyday issues that will affect literally millions of businesses across the EU are still lacking useful answers.

dan-0 8y ago

> Not true. ... unless you plan to use the backups. Then you have to have another service that tracks entities to delete when a backup it's restored... and back that up separately.

drtillberg 8y ago
If you back up a list of things to delete is that GDPR compliant? Ponder.
- dan-0 8y ago
  > If you back up a list of things to delete is that GDPR compliant? Ponder. There's little to ponder, that's why I mentioned "entities" rather than "user data." Use unique keys to reference the data rather than sensitive identifiers. The nontrivial part is storing your backup of entities to be deleted in a way that doesn't get destroyed at the same time as the event that forces you to revert to a backup. This now requires a separate storage, backup, and retrieval mechanism to maintain compliance.
  - erichocean 8y ago
    > Use unique keys to reference the data rather than sensitive identifiers. This is terrible advice. All identifiers are PII and covered by the GDPR, not just the "sensitive" ones.
    - jdietrich 8y ago
      The GDPR does not use the term "personally identifying information" anywhere in the text. Using that term suggests that you either haven't read the text or haven't understood it. "Personal data" (the term actually used in GDPR) means any information relating to an identified or identifiable natural person. The GDPR specifically states that the regulations do not apply to anonymous data. A list of unique keys marked "never restore this data from backups" is not personal data. The data associated with those identifiers is not personal data if it cannot be associated with an identifiable natural person. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/ Quantum has produced a very useful white paper on GDPR in relation to backup and archive systems. https://landing.quantum.com/GDPR_WP_0118_RP.html https://landing.quantum.com/GDPR_WP_0118_RP.html