4 ms·

Two days later the customer files a chargeback with their credit card company and the credit card company wants you to provide documentation for the transaction

Two days later the customer files a chargeback with their credit card company and the credit card company wants you to provide documentation for the transaction.

ATsch 8y ago
Then you have a legal obligation to keep the data, which counts as one of the valid reasons for keeping it, AFAICT.
- alwaysdoit 8y ago
  Credit card company is not a government. It's helpful for business purposes to have records, but it's not always a legal requirement. Anyway this stuff is super complicated and there's no rollback for data that was mistakenly deleted and shouldn't have been, so the point is there are layers and layers of complications and scenarios and it's not as simple as everyone likes to make it out to be. It's not impossible, but it's definitely a lot of difficult work.
throwawaygdpr 8y ago
It is utterly remarkable that the same people who earnestly believe humanity will establish a colony on Mars also think it’s impossible to properly handle PII.
spamizbad 8y ago
IF my understanding is correct, you can actually keep a denormalized version of user information (name, shipping info etc) and still be compliant, assuming you do not use that billing information for any purpose other than billing. The "right to erasure" isn't as strict as the "right to be forgotten" -- You (the end-user) would need to prove that merely having your name and address in billing records violates your right to privacy. And to make that argument you'd have to provide evidence the business is using said information for purposes other than billing. Personal data can be used lawfully to "fulfill contractual obligations with a data subject" (eg: fulfilling a purchase, and retaining information for warranty/returns/RMA etc purposes) and "To perform tasks at the request of a data subject who is in the process of entering into a contract with the controller. " and "For the legitimate interests of a data controller or a third party"

Two days later the customer files a chargeback with their credit card company and the credit card company wants you to provide documentation for the transaction.

ATsch 8y ago

Then you have a legal obligation to keep the data, which counts as one of the valid reasons for keeping it, AFAICT.

alwaysdoit 8y ago
Credit card company is not a government. It's helpful for business purposes to have records, but it's not always a legal requirement. Anyway this stuff is super complicated and there's no rollback for data that was mistakenly deleted and shouldn't have been, so the point is there are layers and layers of complications and scenarios and it's not as simple as everyone likes to make it out to be. It's not impossible, but it's definitely a lot of difficult work.

throwawaygdpr 8y ago

It is utterly remarkable that the same people who earnestly believe humanity will establish a colony on Mars also think it’s impossible to properly handle PII.

spamizbad 8y ago

IF my understanding is correct, you can actually keep a denormalized version of user information (name, shipping info etc) and still be compliant, assuming you do not use that billing information for any purpose other than billing. The "right to erasure" isn't as strict as the "right to be forgotten" -- You (the end-user) would need to prove that merely having your name and address in billing records violates your right to privacy. And to make that argument you'd have to provide evidence the business is using said information for purposes other than billing. Personal data can be used lawfully to "fulfill contractual obligations with a data subject" (eg: fulfilling a purchase, and retaining information for warranty/returns/RMA etc purposes) and "To perform tasks at the request of a data subject who is in the process of entering into a contract with the controller. " and "For the legitimate interests of a data controller or a third party"