3 ms·

Why don't you just delete all their data and not record it? Then you can legitimately respond that you don't have any of their personally identifiable informati

by wlll 8y ago

Why don't you just delete all their data and not record it? Then you can legitimately respond that you don't have any of their personally identifiable information. Also, you're going to either need to suck up the admin time, script it, or block the EU. Take your pick, there's not much point slinging names around. Chances are it's going to happen again and you may as well be ready.

Matticus_Rex 8y ago
> Why don't you just delete all their data and not record it? Because then we have no record of complying with their request, which is something we need to show records of if we're ever audited. > Also, you're going to either need to suck up the admin time, script it, or block the EU. Yes? Does doing that preclude criticizing the clumsy legislation that caused this?
- wlll 8y ago
  Wait, I think I'm starting to see what happened, correct me if I'm wrong. 1. Someone requested you delete their data from your system. 2. You did this and logged their request. That seems legit and pretty much un-jerk like. How did the user know what data you held on them? If they didn't know then the fact that you only held an email address then asking you to delete seems reasonable. Also, did you really only have their name and email? Unless you have a table called "names_and_emails" that isn't linked anywhere else I assume that you've got the user linked to some sort of subscription or something? That's information too. The other possible meaning of what you wrote (and my first understanding) was that the same user sent two deletion requests. That does seem excessive, but then if you complied with the first then the second just becomes a formality at that point surely? > Does doing that preclude criticizing the clumsy legislation that caused this? Wether you think this law is clumsy or not (I don't, I think it's a hell of an improvement on the status quo) it stands a good chance of protecting people's privacy, and as a father that is especially important to me with kids growing up even more intertwined in digital age than I was. As someone who runs a few sites it means some more work for me, but it's worth it. I'm still a person in the world with the need for privacy.

by wlll 8y ago

Matticus_Rex 8y ago

> Why don't you just delete all their data and not record it? Because then we have no record of complying with their request, which is something we need to show records of if we're ever audited. > Also, you're going to either need to suck up the admin time, script it, or block the EU. Yes? Does doing that preclude criticizing the clumsy legislation that caused this?

wlll 8y ago
Wait, I think I'm starting to see what happened, correct me if I'm wrong. 1. Someone requested you delete their data from your system. 2. You did this and logged their request. That seems legit and pretty much un-jerk like. How did the user know what data you held on them? If they didn't know then the fact that you only held an email address then asking you to delete seems reasonable. Also, did you really only have their name and email? Unless you have a table called "names_and_emails" that isn't linked anywhere else I assume that you've got the user linked to some sort of subscription or something? That's information too. The other possible meaning of what you wrote (and my first understanding) was that the same user sent two deletion requests. That does seem excessive, but then if you complied with the first then the second just becomes a formality at that point surely? > Does doing that preclude criticizing the clumsy legislation that caused this? Wether you think this law is clumsy or not (I don't, I think it's a hell of an improvement on the status quo) it stands a good chance of protecting people's privacy, and as a father that is especially important to me with kids growing up even more intertwined in digital age than I was. As someone who runs a few sites it means some more work for me, but it's worth it. I'm still a person in the world with the need for privacy.