4 ms·
Considering Google's data retention policies are GDPR compliant, things will be really deleted within a small N number of days from when they're "deleted." At l
by asdfasgasdgasdg 7y ago
Considering Google's data retention policies are GDPR compliant, things will be really deleted within a small N number of days from when they're "deleted." At least for European users, and I doubt they are maintaining separate policies on this front for other users.
Even in the extremely unlikely event Google was grossly out of compliance, the successor company would still need to obey the law or risk hefty fines, so it shouldn't really matter to you.
- ajdlinux 7y agoAs much as I hate to think about this - what's the probability that Google outlives the GDPR, current trends in privacy laws, or the European Union itself?
- grey-area 7y agolow
- didibus 7y agoI've definitely seen companies having different policies. First, the data is valuable, so keeping it when you are allowed too can be worth it for that. Second, doing a full deletion can be costly in hardware resource utilization, and sometimes even involve some manual labor. So minimizing it can be cost effective.
- groestl 7y agoLegitimate interests are a potential backdoor to keep/sell customer data in the event of bankruptcy or ownership transfer. Provided legitimate interest can be argued, this would still be GDPR compliant. Given the potential value of the data, it's extremely unlikely that noone would try that in court, and before a final decision is made (which could take years), nothing would be deleted.
- groestl 7y agoTo the downvoters: note that I don't argue that it's actually a legitimate interest with respect to the GDPR, only that a third party looking to acquire (parts of) Google is likely to find it worthwile pursuing the chance that it is. This setup will lead to data being retained for longer than a couple of days.
- BillinghamJ 7y agoGDPR doesn't require "real" deletion. You just have to make the data inaccessible
- dvfjsdhgfv 7y agoCitation needed.
- Xylakant 7y agoI don’t have a citation handy, but solutions such as “encrypt hthhe data and instead of deleting the data trash the key” have at least been discussed for environments where actually deleting data is hard (event-based storage, cold long-term backups) etc. From a technological perspective that data would be as good as deleted, even if strictly speaking it still exists.
- xorcist 7y agoOverwriting the data with random data is deleting it.
- Xylakant 7y agoThere’s no data being overwritten in the mechanism I described.
- tempestn 7y agoI believe his point is that in encrypting the data, you are overwriting it - with the encrypted version, which without the key is effectively 'random data'. It's not actually random though, so I don't agree that the data has technically been deleted. Do agree with you that it might as well have been though, so certainly should be good enough.
- Xylakant 7y agoThe idea is slightly different though: you encrypt the individuals data before it ever goes to permanent storage, backup or so. And when it’s time to delete that data, you discard the key instead, effectively making that data inaccessible.
- jjeaff 7y agoI see absolutely no reason they would keep the same policy for regions that don't require it.
- icebraining 7y agoIn fact, we're seeing that now with Facebook: every user outside the US/Canada was technically a user of Facebook Ireland, and when the GDPR came into effect, they all got GDPR rights (EU companies have to comply with the GDPR for all users, not just EU users). Facebook's response was to move everyone except EU users off Facebook Ireland ASAP.
- deadbunny 7y agoBecause maintaining maintaining multiple codebases is inefficient.
- JensRex 7y agoBecause making money off your data is their whole business model, they're very motivated to lose as little of it as possible.
- mgkimsal 7y agothey have dozens/hundreds of systems in different languages run by different teams. nothing was gdpr compliant 2 years ago. there's been a cost to move to that compliance. changing systems you don't have to is also inefficient. you'd need to weigh the delta between the inefficiencies, assuming that 'efficiency' was the primary goal in the first place.
- jjeaff 7y agoDeleting data would not a separate codebase. It would literally be a few different functions that only get called if the country is in the EU. Do you think they run a separate codebase for google.co.uk and google.fr ?