6 ms·
Where's the option for if Google goes under? Does the highest bidder get all-access? Will a corporate re-structure void any existing check-box preferences? Wil
by symplee 7y ago
Where's the option for if Google goes under?
Does the highest bidder get all-access? Will a corporate re-structure void any existing check-box preferences? Will "deleted" information be reincarnated?
- llukas 7y agoGDPR protected users do not need to worry about those questions that much.
- asdfasgasdgasdg 7y agoConsidering Google's data retention policies are GDPR compliant, things will be really deleted within a small N number of days from when they're "deleted." At least for European users, and I doubt they are maintaining separate policies on this front for other users. Even in the extremely unlikely event Google was grossly out of compliance, the successor company would still need to obey the law or risk hefty fines, so it shouldn't really matter to you.
- ajdlinux 7y agoAs much as I hate to think about this - what's the probability that Google outlives the GDPR, current trends in privacy laws, or the European Union itself?
- grey-area 7y agolow
- didibus 7y agoI've definitely seen companies having different policies. First, the data is valuable, so keeping it when you are allowed too can be worth it for that. Second, doing a full deletion can be costly in hardware resource utilization, and sometimes even involve some manual labor. So minimizing it can be cost effective.
- groestl 7y agoLegitimate interests are a potential backdoor to keep/sell customer data in the event of bankruptcy or ownership transfer. Provided legitimate interest can be argued, this would still be GDPR compliant. Given the potential value of the data, it's extremely unlikely that noone would try that in court, and before a final decision is made (which could take years), nothing would be deleted.
- groestl 7y agoTo the downvoters: note that I don't argue that it's actually a legitimate interest with respect to the GDPR, only that a third party looking to acquire (parts of) Google is likely to find it worthwile pursuing the chance that it is. This setup will lead to data being retained for longer than a couple of days.
- BillinghamJ 7y agoGDPR doesn't require "real" deletion. You just have to make the data inaccessible
- dvfjsdhgfv 7y agoCitation needed.
- Xylakant 7y agoI don’t have a citation handy, but solutions such as “encrypt hthhe data and instead of deleting the data trash the key” have at least been discussed for environments where actually deleting data is hard (event-based storage, cold long-term backups) etc. From a technological perspective that data would be as good as deleted, even if strictly speaking it still exists.
- xorcist 7y agoOverwriting the data with random data is deleting it.
- Xylakant 7y agoThere’s no data being overwritten in the mechanism I described.
- tempestn 7y agoI believe his point is that in encrypting the data, you are overwriting it - with the encrypted version, which without the key is effectively 'random data'. It's not actually random though, so I don't agree that the data has technically been deleted. Do agree with you that it might as well have been though, so certainly should be good enough.
- Xylakant 7y agoThe idea is slightly different though: you encrypt the individuals data before it ever goes to permanent storage, backup or so. And when it’s time to delete that data, you discard the key instead, effectively making that data inaccessible.
- jjeaff 7y agoI see absolutely no reason they would keep the same policy for regions that don't require it.
- icebraining 7y agoIn fact, we're seeing that now with Facebook: every user outside the US/Canada was technically a user of Facebook Ireland, and when the GDPR came into effect, they all got GDPR rights (EU companies have to comply with the GDPR for all users, not just EU users). Facebook's response was to move everyone except EU users off Facebook Ireland ASAP.
- deadbunny 7y agoBecause maintaining maintaining multiple codebases is inefficient.
- JensRex 7y agoBecause making money off your data is their whole business model, they're very motivated to lose as little of it as possible.
- mgkimsal 7y agothey have dozens/hundreds of systems in different languages run by different teams. nothing was gdpr compliant 2 years ago. there's been a cost to move to that compliance. changing systems you don't have to is also inefficient. you'd need to weigh the delta between the inefficiencies, assuming that 'efficiency' was the primary goal in the first place.
- jjeaff 7y agoDeleting data would not a separate codebase. It would literally be a few different functions that only get called if the country is in the EU. Do you think they run a separate codebase for google.co.uk and google.fr ?
- fenwick67 7y agoBankruptcy is a hell of a thing. Radioshack sold off consumer information when they went bankrupt, even though that was against what customers agreed to. It wouldn't be a surprise of Google was able to do the same. https://www.pcworld.com/article/2901028/radioshack-puts-customers-personal-data-up-for-sale-in-bankruptcy-auction.html https://www.pcworld.com/article/2901028/radioshack-puts-cust...
- Causality1 7y agoSecure destruction of customer data in the event of bankruptcy is one of the many things we need in a digital rights package.
- ekianjo 7y agoCustomer data is actually an asset so it is worth money. Would be destroying value if it worked this way.
- icebraining 7y agoSo what?
- Someone 7y agoSo, Foo stores your backups, but goes bankrupt. Bar takes over the remaining business, deletes your backups first, and then sends you a new contract? It’s not that they have the data, it’s that they split it from the associated contract. Bankruptcy has little to do with this. It could also happen when Foo stayed in business, or when Bar took over or merged with Foo, without it going bankrupt in-between. The only difference is that, with bankruptcy, there may be a third party that’s guilty of splitting the data from its contract. If Foo is bankrupt, it doesn’t exist anymore, and Bar may buy the data separate from its contract in good faith.
- mgkimsal 7y agoi may not want my data destroyed. and why bankruptcy? why not just change of status? company is sold, or goes public, or goes private, or just changes from llc to c corp, or CEO changes? there's far more things that can happen to a company besides bankruptcy which would cause me to want my relationship and data with the company to terminate.
- sbov 7y ago> Will "deleted" information be reincarnated? A few months back someone working for Google was posting about how their whole job is ensuring deleted data actually gets removed from their systems. It isn't instant but from what they said it seems to work itself through their systems in a relatively timely fashion.
- duxup 7y agoYeah I think that user was responding to a question I had. One of their points was Google has specific written policies about what deleting means and a team(s) whose job it is to do it and make sure it happens.
- m463 7y agoI don't see google going under in our lifetime. That said, this is a common "exit strategy". I think just about every privacy policy (even "good" ones) has a clause that lets the data be transferred elsewhere.