3 ms·

The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is se

The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. For example a service provider can collect emails under the Article 6(b) clause to provide its services. But what happens when a user exits the contract? There's a conflict there because the provider need to keep hold of the email (to avoid user cancelling, asking for deletion then registering for another free trial) while the provider might not be holding consent anymore (Article 6(b) no longer applicable and consent subject to withdrawal at any time) Would it be safe to store an hash of the subject for that purpose? Apparently, not: https://www.sciencedirect.com/science/article/pii/S0267364918300153 https://www.sciencedirect.com/science/article/pii/S026736491... So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law.

dpwm 8y ago
> The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. Best practice now may not be best practice in future. Sure, there could be guidance produced. In fact there is, it's just usually by the enforcing bodies. > what happens when a user exits the contract > to avoid user cancelling, asking for deletion then registering for another free trial You can be sued for six years in the UK. Other jurisdictions I'm not so sure about. If you're providing a service and have agreed a jurisdiction and can be sued in that jurisdiction, there's your lawful basis. The right to be forgotten only applies where the basis is purely consent. If you withdraw consent, and consent is the only basis, your data should be deleted. But if you're providing a service, then another basis applies: contract and legitimate business interest. I think you'll find you have a legitimate business interest and a lawful purpose there for maintaining the email addresses -- as long as you don't later change the purpose and include them on a mailing list. > So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law. It's largely down to the enforcing body. The ICO (UK enforcing body) generally only fine after a major incident or you've failed to stop doing something really bad. Or you've set up a business that is egregiously scummy. You can read the list of fines online. [0] It helps to see it more like fire legislation -- there are many ways to prevent and contain fire. You can seriously reduce the risk of fire and the consequences if one happens. Breaches are similar. If you have a data breach, something's gone wrong. If you're not taking serious mitigation to prevent that from happening, then maybe you shouldn't be taking user data in the first place. [0] https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/
gtsteve 8y ago
You can keep hold of data for a good business reason such as the one you stated. A hash of the e-mail address is probably reasonable, but you might also want some logic to detect users who use g-mail style addresses, i.e. "exampleuser+label@gmailcom", which allows one gmail account to have many forms of the e-mail address, in which case hashes don't work. This is another class of an example I have seen cited around from time to time - a user signs up, performs fraudulent behaviour and then demands the records of this behaviour are removed and continues to perform fraudulent behaviour. You have a good business reason to store this data so therefore the user cannot demand you remove the data. You shouldn't keep it longer than is necessary however. How long would work to deter this behaviour you describe? I'd say 30-90 days should be sufficient.
- LoSboccacc 8y ago
  > A hash of the e-mail address is probably reasonable I even sourced why it isn't but eh, who read post they're replying to, right?

dpwm 8y ago

> The real issue with GDPR is that it's extremely under specified and we're left to educate guesses to find out what and what's not illegal until the matter is settled in courts. Best practice now may not be best practice in future. Sure, there could be guidance produced. In fact there is, it's just usually by the enforcing bodies. > what happens when a user exits the contract > to avoid user cancelling, asking for deletion then registering for another free trial You can be sued for six years in the UK. Other jurisdictions I'm not so sure about. If you're providing a service and have agreed a jurisdiction and can be sued in that jurisdiction, there's your lawful basis. The right to be forgotten only applies where the basis is purely consent. If you withdraw consent, and consent is the only basis, your data should be deleted. But if you're providing a service, then another basis applies: contract and legitimate business interest. I think you'll find you have a legitimate business interest and a lawful purpose there for maintaining the email addresses -- as long as you don't later change the purpose and include them on a mailing list. > So what's the best practice there? We're all taking guesses. And that's not the hallmark of a good law. It's largely down to the enforcing body. The ICO (UK enforcing body) generally only fine after a major incident or you've failed to stop doing something really bad. Or you've set up a business that is egregiously scummy. You can read the list of fines online. [0] It helps to see it more like fire legislation -- there are many ways to prevent and contain fire. You can seriously reduce the risk of fire and the consequences if one happens. Breaches are similar. If you have a data breach, something's gone wrong. If you're not taking serious mitigation to prevent that from happening, then maybe you shouldn't be taking user data in the first place. [0] https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/

gtsteve 8y ago

You can keep hold of data for a good business reason such as the one you stated. A hash of the e-mail address is probably reasonable, but you might also want some logic to detect users who use g-mail style addresses, i.e. "exampleuser+label@gmailcom", which allows one gmail account to have many forms of the e-mail address, in which case hashes don't work. This is another class of an example I have seen cited around from time to time - a user signs up, performs fraudulent behaviour and then demands the records of this behaviour are removed and continues to perform fraudulent behaviour. You have a good business reason to store this data so therefore the user cannot demand you remove the data. You shouldn't keep it longer than is necessary however. How long would work to deter this behaviour you describe? I'd say 30-90 days should be sufficient.

LoSboccacc 8y ago
> A hash of the e-mail address is probably reasonable I even sourced why it isn't but eh, who read post they're replying to, right?