4 ms·

What about old backups (e.g. tape archives, which I think I've read Google uses), how do those get deleted? Do you store and encrypt the data with a user-specif

What about old backups (e.g. tape archives, which I think I've read Google uses), how do those get deleted? Do you store and encrypt the data with a user-specific key and then delete that key upon receiving a deletion request? Perhaps user data is never stored as part of tape backups? Perhaps you have a system which (very slowly) is able to load the appropriate tapes and purge the user's data?

Sheep_McSheepy 8y ago
Cannot comment in too much detail as not sure how much information is public but tape backups are also in scope for wipeout and user data is removed from them.
- hcnews 8y ago
  Is any copy of data anonymized and still kept around in ml models etc.?
  - Sheep_McSheepy 8y ago
    I'm not an expert in this area but from what I know, personalized ML models are rebuilt often from fresh data that is not anonymized so if you request your data to be removed, then it's gone from these models as well. That said, there's also data without PII (anonymized) that is not attached to any specific user, that of course is not subject to this data wipeout as Google wouldn't know what to delete. Such data can be used for general ml models. Not sure how it's done at Google but anonymization is tricky and it's easier to gather two forms of information from the start, one with PII and one without PII. I think most large companies are doing it like that. EDIT: Just remembered one thing. At Google, even when building general models data that is rare cannot be used because it could be used to identify specific people. For example: If search query is used by less than X people on a given day then these queries cannot be used for model building.
    - hcnews 8y ago
      Thanks for the detailed technical answer. It helps; much appreciated.
jefftk 8y ago
The standard way to delete things from cold storage is to encrypt each piece with keys that you can more easily to delete. You can also, of course, read in the data, rewrite it with the deleted portion removed, and write it out again. (Disclosure: I work at Google, though I don't know anything about how Google handles this)

Sheep_McSheepy 8y ago

Cannot comment in too much detail as not sure how much information is public but tape backups are also in scope for wipeout and user data is removed from them.

hcnews 8y ago
Is any copy of data anonymized and still kept around in ml models etc.?
- Sheep_McSheepy 8y ago
  I'm not an expert in this area but from what I know, personalized ML models are rebuilt often from fresh data that is not anonymized so if you request your data to be removed, then it's gone from these models as well. That said, there's also data without PII (anonymized) that is not attached to any specific user, that of course is not subject to this data wipeout as Google wouldn't know what to delete. Such data can be used for general ml models. Not sure how it's done at Google but anonymization is tricky and it's easier to gather two forms of information from the start, one with PII and one without PII. I think most large companies are doing it like that. EDIT: Just remembered one thing. At Google, even when building general models data that is rare cannot be used because it could be used to identify specific people. For example: If search query is used by less than X people on a given day then these queries cannot be used for model building.
  - hcnews 8y ago
    Thanks for the detailed technical answer. It helps; much appreciated.

jefftk 8y ago

The standard way to delete things from cold storage is to encrypt each piece with keys that you can more easily to delete. You can also, of course, read in the data, rewrite it with the deleted portion removed, and write it out again. (Disclosure: I work at Google, though I don't know anything about how Google handles this)