3 ms·

They are definitely not. I’m honestly surprised at how many folks here on HN (a presumably tech savvy crowd) think that Instagram (or any tech co) is “writing z

They are definitely not. I’m honestly surprised at how many folks here on HN (a presumably tech savvy crowd) think that Instagram (or any tech co) is “writing zeros” when a user hits a delete button.

jacquesm 6y ago
Because they should. Incidentally, you are not doing Square any favors with these comments.
- rco8786 6y ago
  I guess? I'm trying to inform folks about data deletion works. And I'm surprised more people here are unaware of how data is stored at large (and small) tech co's.
  - jacquesm 6y ago
    You must be aware that Square is operating a service in a regulated field (fintech) and that openly advertising their possibly illegal business practices is not to their advantage. Let's assume that everything you've said is true that could come in handy one day when a regulator is looking to determine the difference between whether this is an oversight or willful. You are making their job a lot easier and Square's situation a lot more difficult. For your sake I hope that Square plays it as much as they can by the book, and that if they don't that this will cause them to wake up to the fact that all it takes is one employee blabbing online to get them into seriously hot water. People here are on average quite aware of how data is stored, but they are not always empowered to make the call on how it should be stored. As long as that happens behind the curtain it is a problem, but not a huge problem for any particular company. You have just raised Square's profile in many ways at once, not in the least by alerting the hacker community to the fact that Square has a lot more data than they should and that their security measures are not exactly top notch. The consequences could be substantial especially when that deleted data turns up in a dataleak. When you represent your employer online be careful about what you say and write.
    - rco8786 6y ago
      I assure you nothing Square is doing is illegal or even "possibly illegal". Square takes GDPR deletion and right to be forgotten incredibly seriously. But you must understand that soft-deleting an image that the user uploaded is not in violation of any regulation in place in the USA.
      - jacquesm 6y ago
        "I'm trying to inform folks about data deletion works." Is hard to reconcile with this comment. Whether data is an image or some other record is immaterial. If the user (or the controller, for that matter) tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't. Whether your company is based in the USA or not is immaterial. You also responded to an inquiry of Facebook employees as though you were one, when in fact you work somewhere else entirely. I think you mean well but possibly do not understand the implications of your statements here.
- rco8786 6y ago
  I'm responding here because we've hit the limit on the other comment stream, but I truly want you to better informed on this subject so here goes: > Whether data is an image or some other record is immaterial. This is wildly inaccurate. The content of the data is extremely important in determining how to properly store and (potentially) dispose of it. If the data contains PII, or is covered under PCI or HIPAA the processes are entirely different. Even under GDPR erasure requests there is specific guidelines for determining what types data should be deleted and for what data should be "vaulted" (aka soft-delete) rather than hard-deleted. Yes, even under GDPR the regulations say to soft-delete. > If the user tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't. This is, maybe, a good goal for us to set as an industry but let's be perfectly clear - this is not a reflection of reality today and at it's core, this is my only point. I'm not aware of any fines for not hard-deleting a single piece of data but always ready to be more informed here, please shoot me that source. That said, besides the technical challenges of actually deleting the data (which I agree are not a reason or an excuse to not delete it, and the GDPR does a great job of outlining this) there are myriad reasons to keep it around. There's a reason MacOS has Trash and Windows has a Recycle Bin, and a few dozen tools in existence for recovering data even once they've been deleted from those places. Many of these use cases are actually beneficial to the user. "Undelete" is a real thing that users expect to be available (often for good reason)...and this is impossible after writing zeros. Data deletion is a very nuanced subject and treating it as black and white does no one any good. > Whether your company is based in the USA or not is immaterial. Again, incorrect. The regulatory body in effect is extremely material. I mentioned USA because those are the rules I am most familiar with.
  - jacquesm 6y ago
    As engineering manager of a large household name company you really should know better. PII isn't even a term under the GDPR. But feel free to play fast and loose with this and see where it ends up, as far as I'm concerned it can't happen fast enough that regulators crack down on companies that wilfully ignore the law. The GDPR does not say to 'soft delete', it says to delete, and that you should make every reasonable effort to do so. The term 'soft delete' does not occur even once in the reference text for the GDPR. That there are valid cases for soft delete may be true but these are not the norm, they are the exceptions. The owner of the data (end user) has agency. If you wilfully ignore their instructions then you are prime game for the regulators. Whether this data is privacy sensitive or not doesn't matter, the only reason you might be allowed to hold on to it is if there is a legal requirement to do so. Whether the industry as a whole has not caught up with the law - and Square apparently in particular - is a red herring, it should have caught up by now. That companies chose to spend their resources on other things than compliance isn't my problem, but it will be their problem. If you are familiar with the rules in the United States but not the ones in Europe then why do you tell me how the GDPR works when clearly you have no clue. Our compliance officer would have a field day auditing you and you are dangerously incompetent to make all these claims in public representing a company that has a lot of business in Europe and plans to do a whole lot more.

jacquesm 6y ago

Because they should. Incidentally, you are not doing Square any favors with these comments.

rco8786 6y ago
I guess? I'm trying to inform folks about data deletion works. And I'm surprised more people here are unaware of how data is stored at large (and small) tech co's.
- jacquesm 6y ago
  You must be aware that Square is operating a service in a regulated field (fintech) and that openly advertising their possibly illegal business practices is not to their advantage. Let's assume that everything you've said is true that could come in handy one day when a regulator is looking to determine the difference between whether this is an oversight or willful. You are making their job a lot easier and Square's situation a lot more difficult. For your sake I hope that Square plays it as much as they can by the book, and that if they don't that this will cause them to wake up to the fact that all it takes is one employee blabbing online to get them into seriously hot water. People here are on average quite aware of how data is stored, but they are not always empowered to make the call on how it should be stored. As long as that happens behind the curtain it is a problem, but not a huge problem for any particular company. You have just raised Square's profile in many ways at once, not in the least by alerting the hacker community to the fact that Square has a lot more data than they should and that their security measures are not exactly top notch. The consequences could be substantial especially when that deleted data turns up in a dataleak. When you represent your employer online be careful about what you say and write.
  - rco8786 6y ago
    I assure you nothing Square is doing is illegal or even "possibly illegal". Square takes GDPR deletion and right to be forgotten incredibly seriously. But you must understand that soft-deleting an image that the user uploaded is not in violation of any regulation in place in the USA.
    - jacquesm 6y ago
      "I'm trying to inform folks about data deletion works." Is hard to reconcile with this comment. Whether data is an image or some other record is immaterial. If the user (or the controller, for that matter) tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't. Whether your company is based in the USA or not is immaterial. You also responded to an inquiry of Facebook employees as though you were one, when in fact you work somewhere else entirely. I think you mean well but possibly do not understand the implications of your statements here.
rco8786 6y ago
I'm responding here because we've hit the limit on the other comment stream, but I truly want you to better informed on this subject so here goes: > Whether data is an image or some other record is immaterial. This is wildly inaccurate. The content of the data is extremely important in determining how to properly store and (potentially) dispose of it. If the data contains PII, or is covered under PCI or HIPAA the processes are entirely different. Even under GDPR erasure requests there is specific guidelines for determining what types data should be deleted and for what data should be "vaulted" (aka soft-delete) rather than hard-deleted. Yes, even under GDPR the regulations say to soft-delete. > If the user tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't. This is, maybe, a good goal for us to set as an industry but let's be perfectly clear - this is not a reflection of reality today and at it's core, this is my only point. I'm not aware of any fines for not hard-deleting a single piece of data but always ready to be more informed here, please shoot me that source. That said, besides the technical challenges of actually deleting the data (which I agree are not a reason or an excuse to not delete it, and the GDPR does a great job of outlining this) there are myriad reasons to keep it around. There's a reason MacOS has Trash and Windows has a Recycle Bin, and a few dozen tools in existence for recovering data even once they've been deleted from those places. Many of these use cases are actually beneficial to the user. "Undelete" is a real thing that users expect to be available (often for good reason)...and this is impossible after writing zeros. Data deletion is a very nuanced subject and treating it as black and white does no one any good. > Whether your company is based in the USA or not is immaterial. Again, incorrect. The regulatory body in effect is extremely material. I mentioned USA because those are the rules I am most familiar with.
- jacquesm 6y ago
  As engineering manager of a large household name company you really should know better. PII isn't even a term under the GDPR. But feel free to play fast and loose with this and see where it ends up, as far as I'm concerned it can't happen fast enough that regulators crack down on companies that wilfully ignore the law. The GDPR does not say to 'soft delete', it says to delete, and that you should make every reasonable effort to do so. The term 'soft delete' does not occur even once in the reference text for the GDPR. That there are valid cases for soft delete may be true but these are not the norm, they are the exceptions. The owner of the data (end user) has agency. If you wilfully ignore their instructions then you are prime game for the regulators. Whether this data is privacy sensitive or not doesn't matter, the only reason you might be allowed to hold on to it is if there is a legal requirement to do so. Whether the industry as a whole has not caught up with the law - and Square apparently in particular - is a red herring, it should have caught up by now. That companies chose to spend their resources on other things than compliance isn't my problem, but it will be their problem. If you are familiar with the rules in the United States but not the ones in Europe then why do you tell me how the GDPR works when clearly you have no clue. Our compliance officer would have a field day auditing you and you are dangerously incompetent to make all these claims in public representing a company that has a lot of business in Europe and plans to do a whole lot more.