4 ms·

That would cause problems with the GDPR and saying "We have deleted it" and then not deleting it is the type of thing that invites lawsuits.

bigiain 7y ago
"being able to prove they didn't delete it" is a somewhat higher bar that you probably need to at least consider before starting that lawsuit... I've been discussing/arguing recently about whether being able to prove you've deleted the encryption keys for PII that you have on on long term backups/archives is something we'd want to explain to a judge or jury while the opposing counsel keeps saying "But they didn't delete the data! Show me when they deleted the data!"
- vageli 7y ago
  > "being able to prove they didn't delete it" is a somewhat higher bar that you probably need to at least consider before starting that lawsuit... > I've been discussing/arguing recently about whether being able to prove you've deleted the encryption keys for PII that you have on on long term backups/archives is something we'd want to explain to a judge or jury while the opposing counsel keeps saying "But they didn't delete the data! Show me when they deleted the data!" What would an implementation of that look like? Would it rely on hardware keys or something? Because otherwise, even if you can prove you deleted a key (which seems very hard to prove a negative), how can you prove that no copy of the key exists? The same questions can be had for plain unencrypted data deletion as well.
wolco 7y ago
People that fall under GDPR is small compared to the total population using google. While I may be more confident if I was under GDPR, I'm not and I fear the same safeguards will not be in place. Similiar to how laws prevent your own country from spying on you but getting another country to spy on your own citizens is not.
- qtplatypus 7y ago
  About 6.7% of the world population live in the EU (yes this is horrible estimate of the proportion of people in the world who use google as many people don’t have access to the internet). So google would either have to use something to identify which people are in which realm, risking massive fines if they stuff up, then only apply the safeguards for the GDPR people. This seems a rather complex thing to do when the cheaper solution would be to just not bother. I don’t trust google but I do expect companies to be lazy and avoid doing heaps of work for no financial benefit. The benefit that google obtains from our data is in using it to train their ML tech. So after it has been milked for its statistical value as personised data it doesn’t have much worth.

bigiain 7y ago

"being able to prove they didn't delete it" is a somewhat higher bar that you probably need to at least consider before starting that lawsuit... I've been discussing/arguing recently about whether being able to prove you've deleted the encryption keys for PII that you have on on long term backups/archives is something we'd want to explain to a judge or jury while the opposing counsel keeps saying "But they didn't delete the data! Show me when they deleted the data!"

vageli 7y ago
> "being able to prove they didn't delete it" is a somewhat higher bar that you probably need to at least consider before starting that lawsuit... > I've been discussing/arguing recently about whether being able to prove you've deleted the encryption keys for PII that you have on on long term backups/archives is something we'd want to explain to a judge or jury while the opposing counsel keeps saying "But they didn't delete the data! Show me when they deleted the data!" What would an implementation of that look like? Would it rely on hardware keys or something? Because otherwise, even if you can prove you deleted a key (which seems very hard to prove a negative), how can you prove that no copy of the key exists? The same questions can be had for plain unencrypted data deletion as well.

wolco 7y ago

People that fall under GDPR is small compared to the total population using google. While I may be more confident if I was under GDPR, I'm not and I fear the same safeguards will not be in place. Similiar to how laws prevent your own country from spying on you but getting another country to spy on your own citizens is not.

qtplatypus 7y ago
About 6.7% of the world population live in the EU (yes this is horrible estimate of the proportion of people in the world who use google as many people don’t have access to the internet). So google would either have to use something to identify which people are in which realm, risking massive fines if they stuff up, then only apply the safeguards for the GDPR people. This seems a rather complex thing to do when the cheaper solution would be to just not bother. I don’t trust google but I do expect companies to be lazy and avoid doing heaps of work for no financial benefit. The benefit that google obtains from our data is in using it to train their ML tech. So after it has been milked for its statistical value as personised data it doesn’t have much worth.