5 ms·
> Is the requirement to push that deletion to all other SSB instances? Well if you follow the GDPR: yes. Article 17.2 > Where the controller has made the per
by arkh 5y ago
> Is the requirement to push that deletion to all other SSB instances?
Well if you follow the GDPR: yes. Article 17.2
> Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
- 3np 5y agoAre you certain that an app developer for a client would qualify as a Data Controller here? As long as the relevant data never passes through their or other third-party servers and it's strictly local account setup interfacing with SSB I think they are not?
- jaywalk 5y agoIf the personal data is encrypted and you destroy the only key that can be used to decrypt it, is it still personal data? Or is it now simply some random bytes?
- cygned 5y agoWe built a system that creates backups of PII using that mechanism; throw away the key after data is supposed to be deleted. That is legal under EU GDPR.
- deleted 5y ago[deleted]
- arthur_sav 5y agoWhat's funny is that all these laws and (appstore) rules are not very well thought. It comes down to the individual to interpret and enforce a solution that may or may not be in compliance. It's like doing taxes in the US. You may or may not doing it correctly and you'll only find out if they start knocking.
- mike_d 5y agoI had this exact question for our privacy legal team and the answer I got was that deleting the keys to encrypted data is legally equivalent to deleting the data itself.
- vineyardmike 5y ago> taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. This is just not possible for a lot of data like SSB. How would you do this if someone asked github to delete all their commits across repos?
- arkh 5y agoCommits are not personal data in the GDPR sense. > For the purposes of this Regulation: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;