5 ms·

Can you explain to me how the deletion policies work? If you ask for your data to be deleted does that include your address in my contacts? Does it include you

Can you explain to me how the deletion policies work? If you ask for your data to be deleted does that include your address in my contacts? Does it include your messages to me? Does it include your posts that appeared on my feed? In the physical world all of those would be mine. Addresses: It would be my paper address book with your address written in it. Email: would paper letters you sent to me that I keep in my files. Your posts in my feed would be postcards I received from you keep in a scrapbook or shoebox. It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property.

bryanrasmussen 8y ago
The things sent digitally from me to you end being my property and end up being your property immediately as long as the sending is not part of some business arrangement, but if it is some business arrangement that business is regulated, and when it becomes your property if ever can be dependent on many different factors of your business.
willeh 8y ago
> Can you explain to me how the deletion policies work? Disclaimer: The GDPR hasn't been the law of the land for a year, so there is little precedent. It is fairly simple, the GDPR requires that companies that control identifying information about you (or somehow delegate this), have acceptable reasons for doing so (user consent/other law/etc). When some entity controls your information the GDPR gives you certain rights. The key point here is that the company is controlling your information not you, whereas the scrapbook is under your control. The loss of control of the information creates in my mind a moral obligation to treat it a certain way. One of the rights that the GDPR confers on the data-subject is the having data deleted, this right is not absolute and if you have any other grounds (e.g. AML regulation) for keeping the data then you don't have to delete it. Additionally, deletion doesn't have to be immediately consistent, so you won't have to go into old backups and delete the data there. TL;DR: If someone asks you to remove something, just delete it from your SQL database, and that's it. There are two key costs for startups implementing the GDPR: 1. Privacy by Design - Make some efforts to design the information systems in your company in a way that promotes privacy. 2. Demonstrating compliance - This tasks scales with company size, you might start out with a boilerplate privacy policy, but as you grow want to be more diligent.
- tokyodude 8y ago
  this doesn't help clarify things at all. you send me an email. I use Gmail. you request Google delete all your data. does google have to delete the email from you that's in my inbox?
y0ghur7_xxx 8y ago
> If you ask for your data to be deleted does that include your address in my contacts? If that address is visible to you because I gave you access to my data, then yes. If that address is visible to you because I gave it to you and you put it there by yourself, then no. > Does it include your messages to me? No. Messages I wrote to you are yours. I gave them to you. You can keep them. They get deleted when/if you ask for your account to be deleted. > Does it include your posts that appeared on my feed? Yes. My posts are mine. If I make them public or share them with you, you can look at them, copy them, do what you want with them (depending on the license). If I remove my account they get deleted from my account. If you made a copy for yourself, you can keep the copy. > It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. As always, ask a lawyer.
- geocar 8y ago
  > If I remove my account they get deleted from my account. Maybe. There's an argument for the public good that can be appropriate (e.g. a public figure on twitter).
geocar 8y ago
> It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. The ICO gives really good advice on this. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
belorn 8y ago
I think that the best way to view the deletion policy is to imagine what would happen if someone stole the data. If it is anything that could get you sued over then that is data that needed to be deleted. This will likely cover a bit more than if it was physical objects. To be fair, most physical paper address books would not include millions/billions of addresses, and would unlikely be stolen by accident. The only one that has billions of paper letters are the post office which is regulated. The physical world is not very different to GDPR if one includes the context of how many book shelves of information is being stored on companies databases.
- CWuestefeld 8y ago
  I don't think that's correct. A business has the right to retain records that are necessary for them to do business. From the lawyer that advised us in this, his call was that Order History data doesn't need to be expurgated even though it contains the person's name and address, etc. There are any number of business reasons dictating that we need a record of this stuff (e.g., auditing for sales tax compliance; being able to handle customer returns in the future, or fraud claims from the credit card processor).
Sir_Substance 8y ago
>If you ask for your data to be deleted does that include your address in my contacts? I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR, and that the thrust of your question revolves around, say, a customer support portal. Yes, addresses have to go unless you have a legitimate business reason to keep them. For tax purposes or to prove something in an active court case are both examples of a reason you could keep the address at least temporarily. >Does it include your messages to me? No, they could be anonymised instead. If the messages contain PII you might need to sanitize them. >Does it include your posts that appeared on my feed? Same as the previous question. >It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. This is defined on, like, the second page of the GDPR document. Article 2 "material scope" point 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. GDPR kicks in when you start processing this stuff automatically. If you want to handle your entire businesses paperwork via a set of paper ledgers with humans in front of them, that'll make you GDPR immune. Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. If someone told you GDPR was complex, they lied to you. The legislation is dead simple and most of the document is actually not about what businesses need to do but about what the EU bureaucrats need to do. You only need to read about half of it, the rest is irrelevant to you. If this matters to you, just go read the damn thing. Trust me, it's a fricking revelation to do so, you'll be staggered by the amount of bullshit people spout about it and the amount of needless fretting and hand-wringing they do once you know how simple it is. Don't get me wrong, the implementation may be hard for some businesses, but I'll also tell you straight up, there are lots of businesses voluntarily making their GDPR implementations harder and more expensive than necessary because they didn't bother actually reading the law and are instead going off third-hand chinese-whisper information, which is a crazy way to run a business.
- XCabbage 8y ago
  > I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Does Google, as the data controller who ultimately stores tokyodude's contact list for him, then have to purge your email address from tokyodude's address book? > Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. This condescension is obnoxious and unwarranted. Just take a look at the complexity of the conditions at https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ dictating when the right to erasure applies. Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. So can they just argue they have a "legitimate interest", under article 6(1) point (a), in preserving tokyodude's address book? I have no idea. Meanwhile, point (f), linking to article 8 about children, is saying - I think - that a data controller must honour an erasure request if it's about data they collected from a child, even if they have another legal ground for processing that data. So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? How about your actual emails to him? Can you demand that Google deletes them from his inbox? As far as I can see, the answer logically ought to be "yes"; Art 17 (1) (f) applies and I don't see any exception that would let Google wriggle out of the obligation. But I'm not sure if any of the above, because this stuff is vague and complicated. If you truly think it's simple, I invite you to walk us through the answers to the scenarios I've explored above, supporting your assertions with relevant references to the text of the law. I do not expect you to be able to do so.
icebraining 8y ago
In the physical world all of those would be mine. This is a common misconception, but the GDPR applies to the physical world as well. The regulation only talks about "personal data in a filing system", which is a generic term.

bryanrasmussen 8y ago

The things sent digitally from me to you end being my property and end up being your property immediately as long as the sending is not part of some business arrangement, but if it is some business arrangement that business is regulated, and when it becomes your property if ever can be dependent on many different factors of your business.

willeh 8y ago

> Can you explain to me how the deletion policies work? Disclaimer: The GDPR hasn't been the law of the land for a year, so there is little precedent. It is fairly simple, the GDPR requires that companies that control identifying information about you (or somehow delegate this), have acceptable reasons for doing so (user consent/other law/etc). When some entity controls your information the GDPR gives you certain rights. The key point here is that the company is controlling your information not you, whereas the scrapbook is under your control. The loss of control of the information creates in my mind a moral obligation to treat it a certain way. One of the rights that the GDPR confers on the data-subject is the having data deleted, this right is not absolute and if you have any other grounds (e.g. AML regulation) for keeping the data then you don't have to delete it. Additionally, deletion doesn't have to be immediately consistent, so you won't have to go into old backups and delete the data there. TL;DR: If someone asks you to remove something, just delete it from your SQL database, and that's it. There are two key costs for startups implementing the GDPR: 1. Privacy by Design - Make some efforts to design the information systems in your company in a way that promotes privacy. 2. Demonstrating compliance - This tasks scales with company size, you might start out with a boilerplate privacy policy, but as you grow want to be more diligent.

tokyodude 8y ago
this doesn't help clarify things at all. you send me an email. I use Gmail. you request Google delete all your data. does google have to delete the email from you that's in my inbox?

y0ghur7_xxx 8y ago

> If you ask for your data to be deleted does that include your address in my contacts? If that address is visible to you because I gave you access to my data, then yes. If that address is visible to you because I gave it to you and you put it there by yourself, then no. > Does it include your messages to me? No. Messages I wrote to you are yours. I gave them to you. You can keep them. They get deleted when/if you ask for your account to be deleted. > Does it include your posts that appeared on my feed? Yes. My posts are mine. If I make them public or share them with you, you can look at them, copy them, do what you want with them (depending on the license). If I remove my account they get deleted from my account. If you made a copy for yourself, you can keep the copy. > It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. As always, ask a lawyer.

geocar 8y ago
> If I remove my account they get deleted from my account. Maybe. There's an argument for the public good that can be appropriate (e.g. a public figure on twitter).

geocar 8y ago

> It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. The ICO gives really good advice on this. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

belorn 8y ago

I think that the best way to view the deletion policy is to imagine what would happen if someone stole the data. If it is anything that could get you sued over then that is data that needed to be deleted. This will likely cover a bit more than if it was physical objects. To be fair, most physical paper address books would not include millions/billions of addresses, and would unlikely be stolen by accident. The only one that has billions of paper letters are the post office which is regulated. The physical world is not very different to GDPR if one includes the context of how many book shelves of information is being stored on companies databases.

CWuestefeld 8y ago
I don't think that's correct. A business has the right to retain records that are necessary for them to do business. From the lawyer that advised us in this, his call was that Order History data doesn't need to be expurgated even though it contains the person's name and address, etc. There are any number of business reasons dictating that we need a record of this stuff (e.g., auditing for sales tax compliance; being able to handle customer returns in the future, or fraud claims from the credit card processor).

Sir_Substance 8y ago

>If you ask for your data to be deleted does that include your address in my contacts? I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR, and that the thrust of your question revolves around, say, a customer support portal. Yes, addresses have to go unless you have a legitimate business reason to keep them. For tax purposes or to prove something in an active court case are both examples of a reason you could keep the address at least temporarily. >Does it include your messages to me? No, they could be anonymised instead. If the messages contain PII you might need to sanitize them. >Does it include your posts that appeared on my feed? Same as the previous question. >It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property. This is defined on, like, the second page of the GDPR document. Article 2 "material scope" point 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. GDPR kicks in when you start processing this stuff automatically. If you want to handle your entire businesses paperwork via a set of paper ledgers with humans in front of them, that'll make you GDPR immune. Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. If someone told you GDPR was complex, they lied to you. The legislation is dead simple and most of the document is actually not about what businesses need to do but about what the EU bureaucrats need to do. You only need to read about half of it, the rest is irrelevant to you. If this matters to you, just go read the damn thing. Trust me, it's a fricking revelation to do so, you'll be staggered by the amount of bullshit people spout about it and the amount of needless fretting and hand-wringing they do once you know how simple it is. Don't get me wrong, the implementation may be hard for some businesses, but I'll also tell you straight up, there are lots of businesses voluntarily making their GDPR implementations harder and more expensive than necessary because they didn't bother actually reading the law and are instead going off third-hand chinese-whisper information, which is a crazy way to run a business.

XCabbage 8y ago
> I'm assuming that "my" in this sentence means a business, since individuals are not subject to GDPR No; tokyodude is asking what happens if you request that (for example) Google erases your data, and he has your email address in his Gmail contacts. Does Google, as the data controller who ultimately stores tokyodude's contact list for him, then have to purge your email address from tokyodude's address book? > Listen man, I read the GDPR document /once/ almost a year ago now, and I remember the answers to your questions off the top of my head. I'm not a lawyer either, I'm a software engineer. This condescension is obnoxious and unwarranted. Just take a look at the complexity of the conditions at https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ dictating when the right to erasure applies. Point (b) seems to suggest that it applies by default if the basis for originally processing the data was the subject's consent... but that the controller can override that if they have another legal ground for processing. So can they just argue they have a "legitimate interest", under article 6(1) point (a), in preserving tokyodude's address book? I have no idea. Meanwhile, point (f), linking to article 8 about children, is saying - I think - that a data controller must honour an erasure request if it's about data they collected from a child, even if they have another legal ground for processing that data. So even if the legitimate interests argument above would hold, if you're a 12-year-old, I think you absolutely can demand that your email address be purged from tokyodude's address book and he can't do anything about it? How about your actual emails to him? Can you demand that Google deletes them from his inbox? As far as I can see, the answer logically ought to be "yes"; Art 17 (1) (f) applies and I don't see any exception that would let Google wriggle out of the obligation. But I'm not sure if any of the above, because this stuff is vague and complicated. If you truly think it's simple, I invite you to walk us through the answers to the scenarios I've explored above, supporting your assertions with relevant references to the text of the law. I do not expect you to be able to do so.

icebraining 8y ago

In the physical world all of those would be mine. This is a common misconception, but the GDPR applies to the physical world as well. The regulation only talks about "personal data in a filing system", which is a generic term.