6 ms·

You would keep a list of unique identifiers (opaque) that were deleted and filter data out prior to rewriting/restoring it. It’s cumbersome but not impossible.

ww520 8y ago
So basically more work.
- lovich 8y ago
  No shit, you could save a ton of work by just ignoring a ton of things society and the government have decided are necessary for a business to operate inside of that society?. Why not throw your trash on a neighbor's lawn? Why not enslave your workers so you don't have to deal with turnover and hiring replacements? Why dont you stop paying taxes so you don't have to do work to get the same amount of income as you would without taxes? All of those things would be less work, right?
  - axlprose 8y ago
    >Why not throw your trash on a neighbor's lawn? Why not enslave your workers so you don't have to deal with turnover and hiring replacements? Why dont you stop paying taxes so you don't have to do work to get the same amount of income as you would without taxes? None of those examples make sense from a classical economics perspective, nor would they be considered sustainable from a game theoretic perspective either. Meanwhile, not complying with the GDPR doesn't seem to have any obviously severe economic/game-theoretic consequences if you're not based in the EU, or don't already have a large profitable presence there. So it's a bit disingenuous to just lump it in with all those other behaviors.
    - lovich 8y ago
      >None of those examples make sense from a classical economics perspective, nor would they be considered sustainable from a game theoretic perspective either. Please explain how. Not complying with the GDPR doesn't have any obvious consequences because every company that sells user data is pushing their negative externalities onto others. The GDPR is trying to make it so that the people creating the negative externalities are the ones paying for them
      - axlprose 8y ago
        >Please explain how. Assuming you legitimately want to know, and aren't just trying to ask a pointed rhetorical question, ok: >>Why not throw your trash on a neighbor's lawn? Because unless you like having other people's trash on your lawn, a simple tit-for-tat strategy in game theory would suggest that it's in your best interest to not do that yourself either. In other words, the most sustainable course of action in this case is to follow The Golden Rule ("do unto others as you would like them to do unto you"). The thing with the GDPR, is that the parties involved in the game are you and the EU government, and you not complying with the GDPR by just refusing to serve EU customers doesn't put you in line for any kind of equivalent retaliation if you delete all your EU user data first. >>Why not enslave your workers so you don't have to deal with turnover and hiring replacements? Because in a developed free market economy, that business strategy is doomed to fail, since your workers can choose to go work somewhere else that has more favorable conditions, and will likely warn any potential future workers against working for you. If you maintain these sorts of business practices long enough, eventually your pool of workers to choose from will shrink to the point where you'll no longer have enough viable candidates to replenish your workforce. Similarly, if your business is in fact collecting sensitive data and abusing its use of it for shady purposes, your customers will eventually start looking for a way out of dealing with you (as is possibly the case with facebook right now). However, the key distinction that seems to be missed by a lot of people here, is that not complying with the GDPR does not inherently guarantee that a business is either collecting dubious data, nor that it's doing shady things with it. And this is a result of the fact that companies around the world are not obligated to conduct business in the EU. If they magically were obligated somehow, it'd be a different story, but that's never going to be the case. For example, if a new business starts up in the US right now, it will not actively have any EU user data yet, but could still opt to not comply with the GDPR purely because of the overhead costs, and just block EU users altogether in order to avoid any hassles in the future. Does this mean that the business is doing questionable things with user data? Obviously not, since it hasn't even had a chance to collect any data yet, but clearly it positioned itself in a way that it found to be the most advantageous for its given resources, at the detriment of any potential future EU users, without risking any obvious repercussions other than having a slightly smaller potential market. If all of its competitors decide to comply with the GDPR and serve EU customers however, then the strategy could turn out to be a losing one, but it's far from a given that this will happen. >>Why dont you stop paying taxes so you don't have to do work to get the same amount of income as you would without taxes? Because not paying taxes will get you jail time and/or non-trivial fines in pretty much every country you could possibly be based out of. I know there are quacks in the US that claim you can "legally" not pay any income taxes, but none of those crazy arguments have ever stood up in court, and have historically landed tax avoiders that tried to argue for them in jail. Regardless of how you feel about taxes, needlessly incurring large fees and/or landing yourself in jail, just isn't gonna be good for business, so it's in your best interest to pay them even if you're a raging psychopath/narcissist. >Not complying with the GDPR doesn't have any obvious consequences because every company that sells user data is pushing their negative externalities onto others. Not complying with the GDPR != selling user data. This argument is moot because it doesn't logically follow that not complying with the GDPR necessarily produces these "negative externalities" that you're referring to. Therefore, it doesn't explain anything about why not following the GDPR doesn't have obvious consequences. Refer to my hypothetical startup example above for elaboration, because this is an example of conflating "data collection/dubious practices" with "GDPR compliance", which are two very different things. >The GDPR is trying to make it so that the people creating the negative externalities are the ones paying for them I agree that that's what it's trying to do. Unfortunately, it seems like it might be having some unintended consequences along the way regardless.
  - ww520 8y ago
    Yes, so just block EU. End of story.
    - lovich 8y ago
      I mean yeah. I think it's leaving money on the table, but it's certainly a valid option as long as you aren't processing EU residents personal data in violation of the GPDR still and have money/assets flowing through the EU. If you don't have anything within their jurisdiction there's not much they can do to you
colejohnson66 8y ago
So I need to keep a list of people to delete from my backups when I restore them? Is keeping that list even GDPR compliant?
- parrellel 8y ago
  The gist seems, if you are sticking your fingers into your ears hard enough and shouting loud enough, it should count, maybe, in at least most European nations. But remember, strictest interpretation wins.
berti 8y ago
So you then need to make sure that dataset is at least as resilient as your cold backups. That's not exactly a trivial problem in most cases.

ww520 8y ago

So basically more work.

lovich 8y ago
No shit, you could save a ton of work by just ignoring a ton of things society and the government have decided are necessary for a business to operate inside of that society?. Why not throw your trash on a neighbor's lawn? Why not enslave your workers so you don't have to deal with turnover and hiring replacements? Why dont you stop paying taxes so you don't have to do work to get the same amount of income as you would without taxes? All of those things would be less work, right?
- axlprose 8y ago
  >Why not throw your trash on a neighbor's lawn? Why not enslave your workers so you don't have to deal with turnover and hiring replacements? Why dont you stop paying taxes so you don't have to do work to get the same amount of income as you would without taxes? None of those examples make sense from a classical economics perspective, nor would they be considered sustainable from a game theoretic perspective either. Meanwhile, not complying with the GDPR doesn't seem to have any obviously severe economic/game-theoretic consequences if you're not based in the EU, or don't already have a large profitable presence there. So it's a bit disingenuous to just lump it in with all those other behaviors.
  - lovich 8y ago
    >None of those examples make sense from a classical economics perspective, nor would they be considered sustainable from a game theoretic perspective either. Please explain how. Not complying with the GDPR doesn't have any obvious consequences because every company that sells user data is pushing their negative externalities onto others. The GDPR is trying to make it so that the people creating the negative externalities are the ones paying for them
    - axlprose 8y ago
      >Please explain how. Assuming you legitimately want to know, and aren't just trying to ask a pointed rhetorical question, ok: >>Why not throw your trash on a neighbor's lawn? Because unless you like having other people's trash on your lawn, a simple tit-for-tat strategy in game theory would suggest that it's in your best interest to not do that yourself either. In other words, the most sustainable course of action in this case is to follow The Golden Rule ("do unto others as you would like them to do unto you"). The thing with the GDPR, is that the parties involved in the game are you and the EU government, and you not complying with the GDPR by just refusing to serve EU customers doesn't put you in line for any kind of equivalent retaliation if you delete all your EU user data first. >>Why not enslave your workers so you don't have to deal with turnover and hiring replacements? Because in a developed free market economy, that business strategy is doomed to fail, since your workers can choose to go work somewhere else that has more favorable conditions, and will likely warn any potential future workers against working for you. If you maintain these sorts of business practices long enough, eventually your pool of workers to choose from will shrink to the point where you'll no longer have enough viable candidates to replenish your workforce. Similarly, if your business is in fact collecting sensitive data and abusing its use of it for shady purposes, your customers will eventually start looking for a way out of dealing with you (as is possibly the case with facebook right now). However, the key distinction that seems to be missed by a lot of people here, is that not complying with the GDPR does not inherently guarantee that a business is either collecting dubious data, nor that it's doing shady things with it. And this is a result of the fact that companies around the world are not obligated to conduct business in the EU. If they magically were obligated somehow, it'd be a different story, but that's never going to be the case. For example, if a new business starts up in the US right now, it will not actively have any EU user data yet, but could still opt to not comply with the GDPR purely because of the overhead costs, and just block EU users altogether in order to avoid any hassles in the future. Does this mean that the business is doing questionable things with user data? Obviously not, since it hasn't even had a chance to collect any data yet, but clearly it positioned itself in a way that it found to be the most advantageous for its given resources, at the detriment of any potential future EU users, without risking any obvious repercussions other than having a slightly smaller potential market. If all of its competitors decide to comply with the GDPR and serve EU customers however, then the strategy could turn out to be a losing one, but it's far from a given that this will happen. >>Why dont you stop paying taxes so you don't have to do work to get the same amount of income as you would without taxes? Because not paying taxes will get you jail time and/or non-trivial fines in pretty much every country you could possibly be based out of. I know there are quacks in the US that claim you can "legally" not pay any income taxes, but none of those crazy arguments have ever stood up in court, and have historically landed tax avoiders that tried to argue for them in jail. Regardless of how you feel about taxes, needlessly incurring large fees and/or landing yourself in jail, just isn't gonna be good for business, so it's in your best interest to pay them even if you're a raging psychopath/narcissist. >Not complying with the GDPR doesn't have any obvious consequences because every company that sells user data is pushing their negative externalities onto others. Not complying with the GDPR != selling user data. This argument is moot because it doesn't logically follow that not complying with the GDPR necessarily produces these "negative externalities" that you're referring to. Therefore, it doesn't explain anything about why not following the GDPR doesn't have obvious consequences. Refer to my hypothetical startup example above for elaboration, because this is an example of conflating "data collection/dubious practices" with "GDPR compliance", which are two very different things. >The GDPR is trying to make it so that the people creating the negative externalities are the ones paying for them I agree that that's what it's trying to do. Unfortunately, it seems like it might be having some unintended consequences along the way regardless.
- ww520 8y ago
  Yes, so just block EU. End of story.
  - lovich 8y ago
    I mean yeah. I think it's leaving money on the table, but it's certainly a valid option as long as you aren't processing EU residents personal data in violation of the GPDR still and have money/assets flowing through the EU. If you don't have anything within their jurisdiction there's not much they can do to you

colejohnson66 8y ago

So I need to keep a list of people to delete from my backups when I restore them? Is keeping that list even GDPR compliant?

parrellel 8y ago
The gist seems, if you are sticking your fingers into your ears hard enough and shouting loud enough, it should count, maybe, in at least most European nations. But remember, strictest interpretation wins.

berti 8y ago

So you then need to make sure that dataset is at least as resilient as your cold backups. That's not exactly a trivial problem in most cases.