4 ms·
If the personal data is encrypted and you destroy the only key that can be used to decrypt it, is it still personal data? Or is it now simply some random bytes?
by jaywalk 5y ago
If the personal data is encrypted and you destroy the only key that can be used to decrypt it, is it still personal data? Or is it now simply some random bytes?
- cygned 5y agoWe built a system that creates backups of PII using that mechanism; throw away the key after data is supposed to be deleted. That is legal under EU GDPR.
- deleted 5y ago[deleted]
- arthur_sav 5y agoWhat's funny is that all these laws and (appstore) rules are not very well thought. It comes down to the individual to interpret and enforce a solution that may or may not be in compliance. It's like doing taxes in the US. You may or may not doing it correctly and you'll only find out if they start knocking.
- mike_d 5y agoI had this exact question for our privacy legal team and the answer I got was that deleting the keys to encrypted data is legally equivalent to deleting the data itself.