3 ms·
Looks interesting. Although the example has a TTL of 7 days for the session cookie, which contains an identifier used by the service provider to uniquely finger
by timrichard 8y ago
Looks interesting. Although the example has a TTL of 7 days for the session cookie, which contains an identifier used by the service provider to uniquely fingerprint an individual user. Under GDPR, does all trace of a user have to be removed immediately on demand, even if this has been effectively delegated to something like the ALB?
- edf13 8y agoDon't think it states anywhere that all trace of a user have to be removed immediately on demand. Generally speaking you have 30 days to remove personal data (But there is a bit more to it than that). A good overview is from the UK ICO: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- bjpbakker 8y agoAlso, it has to be technically feasible to remove the user data. So I don't think data stored on the client's own device is data that you necessarily should remove (though IANAL).