5 ms·

I think it should be a legal requirement that users are able to configure retention of their data. For instance that any content you post will only be retained

by bborud 5y ago

I think it should be a legal requirement that users are able to configure retention of their data. For instance that any content you post will only be retained for N number of weeks/ months/years. And that social media platforms over a certain size have to agree to auditing to ensure that this data is actually deleted.

dotancohen 5y ago
As someone who implements these types of requirements, this suggestion just adds complexity where none is needed. In the software, and the database, and the backup strategy, and for the average user. Complexity requires time, money, and introduces bugs and user error. Right now we are required by law to remove user data upon request (Europe). That law is strong enough to cover those who need it.
- Zy-Zario 5y ago
  Actually, Telegram already does that. Similar to how your gmail account is automatically deleted after a certain time.
- sleepyhead 5y ago
  Actually GDPR requires you to delete data when no longer needed. How long data is needed depends on what type of data it is. For example financial transactions are covered by other laws to be kept for certain amount of time. If data is linked to a survey that is completed then, by law, that data is no longer needed and should be deleted. How long should photo likes and comments be kept? I don't think there are good guidelines or judgements regarding this but it is nevertheless something to take into consideration and in most cases delete data based on age.
- bborud 5y ago
  Are you suggesting that not inconveniencing developers is more important than a right to privacy? I'd have to disagree with you if this is the case. I've worked both for companies that fall under extra scrutiny by government due to market position and for companies that deal with data that has strict retention limits. Yes, it increases complexity, but the laws that seek to protect people's privacy are far more important than any inconvenience to companies. (And yes: in both cases there were regular audits and any lack of compliance had very real consequences)
  - dotancohen 5y ago
    > Are you suggesting that not inconveniencing developers > is more important than a right to privacy? I would very much appreciate if you could show me which of my words led you to that conclusion. Thank you.
quaintdev 5y ago
This argument is flawed. How can you be sure if the policy is enforced at back-end? The better way is to create a solution where users have control over data and the apps interact with data. This should have been the model from the beginning but now I guess it will never happen. Even if someone successfully implements this it will be just as hard IPv6 to adopt if not more.
- bborud 5y ago
  Audits. (And yes, I've worked for companies that deal with lots of data that has strict retention limits by law, and oh boy were there audits and oh boy are you in trouble if/when you screw up) As for your proposed solution: I don't think I understand what you mean. Could you expand on it?
  - quaintdev 5y ago
    True audits are really good way to keep companies in check but what about a company like TikTok or companies in other countries where you are not sure if the audits are not compromised. Regarding the solution I was talking about check out Solid by Tim Berners Lee
    - bborud 5y ago
      Naturally you can only perform meaningful audits if you can have them performed by a party you trust and you have the ability to impose sanctions due to non-compliance. That's not going to be true for all companies, but it will be true for many companies. Especially if they have any form of economic activity within some jurisdiction. Then it is up to the users to choose services that are under some acceptable regulatory control. The fact that it can't be made perfect with one move doesn't matter. If things can incrementally be made better for the users whose data is used to generate immense revenue, that's a step in the right direction. Decentralized models are interesting, but surprisingly hard to do, let alone do well. Not only from a technical point of view, but from a business point of view. There is also the challenge that just about every incumbent today has a vested interest in making sure these ideas do not get traction as it would rob them of what makes companies valuable.
deleted 5y ago
[deleted]

by bborud 5y ago

dotancohen 5y ago

As someone who implements these types of requirements, this suggestion just adds complexity where none is needed. In the software, and the database, and the backup strategy, and for the average user. Complexity requires time, money, and introduces bugs and user error. Right now we are required by law to remove user data upon request (Europe). That law is strong enough to cover those who need it.

Zy-Zario 5y ago
Actually, Telegram already does that. Similar to how your gmail account is automatically deleted after a certain time.
sleepyhead 5y ago
Actually GDPR requires you to delete data when no longer needed. How long data is needed depends on what type of data it is. For example financial transactions are covered by other laws to be kept for certain amount of time. If data is linked to a survey that is completed then, by law, that data is no longer needed and should be deleted. How long should photo likes and comments be kept? I don't think there are good guidelines or judgements regarding this but it is nevertheless something to take into consideration and in most cases delete data based on age.
bborud 5y ago
Are you suggesting that not inconveniencing developers is more important than a right to privacy? I'd have to disagree with you if this is the case. I've worked both for companies that fall under extra scrutiny by government due to market position and for companies that deal with data that has strict retention limits. Yes, it increases complexity, but the laws that seek to protect people's privacy are far more important than any inconvenience to companies. (And yes: in both cases there were regular audits and any lack of compliance had very real consequences)
- dotancohen 5y ago
  > Are you suggesting that not inconveniencing developers > is more important than a right to privacy? I would very much appreciate if you could show me which of my words led you to that conclusion. Thank you.

quaintdev 5y ago

This argument is flawed. How can you be sure if the policy is enforced at back-end? The better way is to create a solution where users have control over data and the apps interact with data. This should have been the model from the beginning but now I guess it will never happen. Even if someone successfully implements this it will be just as hard IPv6 to adopt if not more.

bborud 5y ago
Audits. (And yes, I've worked for companies that deal with lots of data that has strict retention limits by law, and oh boy were there audits and oh boy are you in trouble if/when you screw up) As for your proposed solution: I don't think I understand what you mean. Could you expand on it?
- quaintdev 5y ago
  True audits are really good way to keep companies in check but what about a company like TikTok or companies in other countries where you are not sure if the audits are not compromised. Regarding the solution I was talking about check out Solid by Tim Berners Lee
  - bborud 5y ago
    Naturally you can only perform meaningful audits if you can have them performed by a party you trust and you have the ability to impose sanctions due to non-compliance. That's not going to be true for all companies, but it will be true for many companies. Especially if they have any form of economic activity within some jurisdiction. Then it is up to the users to choose services that are under some acceptable regulatory control. The fact that it can't be made perfect with one move doesn't matter. If things can incrementally be made better for the users whose data is used to generate immense revenue, that's a step in the right direction. Decentralized models are interesting, but surprisingly hard to do, let alone do well. Not only from a technical point of view, but from a business point of view. There is also the challenge that just about every incumbent today has a vested interest in making sure these ideas do not get traction as it would rob them of what makes companies valuable.

deleted 5y ago

[deleted]