3 ms·
When GDPR first came out, I found the terms pretty vague. I don't know how I can implement it. For example, a user's email is Personally Identifiable Informati
by billconan 7y ago
When GDPR first came out, I found the terms pretty vague. I don't know how I can implement it.
For example, a user's email is Personally Identifiable Information. When the user wants to delete her account, I shall remove her email. This is ease.
But what if in my comment system, another user mentioned her email in a comment. Do I need to remove this comment too? What if this comment has replies too, should I remove all the replies?
What if a competitor make use of these undocumented gray areas to attack my business?
- anoncake 7y ago> What if a competitor make use of these undocumented gray areas to attack my business? Then your regulator might ask you to remove the comment in question.
- Drdrdrq 7y agoYes, you need to remove the said comment (or PII in it) upon their request (ianal,...). I don't see how a competitor could abuse that.
- billconan 7y agoBecause you now need to implement a full text search or even natural language processing to identify personal identities in your comment, and that’s quite challenging. An evil competitor could register several accounts, purposely leave those comments with personal identities of those accounts on the system and then request to remove one of the accounts. Your algorithm needs to parse those comments, identify which Comments mentioned the to be removed identity, and remove them without breaking the integrity of your database. Failing to do that, you get sued...