4 ms·

You clone the database and remove/update the corresponding lines. GDPR does not mean, you have to fix it right away, imho.

by okr 5y ago

gnabgib 5y ago
Article 17 does include the term "without undue delay"[0], but such vague language seems ripe for some court precedent. A clone and remove/update per GDPR request seems like undue delay, certainly one that could be avoided by alternative architecture choices (keep the personally identifiable information (PII) in a mutable store) [0]: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
- deleted 5y ago
  [deleted]
- sigzero 5y ago
  No, it's not undue delay. That's just how it currently works and that is a fine argument.
peoplefromibiza 5y ago
But you have to do in a pretty short timeframe > Under Article 12.3 of the GDPR, you have 30 days to provide information on the action your organization will decide to take on a legitimate erasure request. This timeframe can be extended up to 60 days depending on the complexity of the request. even if they ask for more time, first communication has to come within 30 days
- topspin 5y ago
  So, no deadline for the actual deletion? Your 'first communication' could say "your data will be deleted at some point between now and ten years from now" and be compliant?
  - peoplefromibiza 5y ago
    No, it says: 30 days, maximum 60, if you need 60 you have to communicate it within the first 30 with a motivation. It looks pretty straightforward English to me. GDPR is published in 24 languages, including English, I don't know why people still don't get it and what's so hard to understand. It's not a single law, it's a collection of articles, the 17th says that data should be erased without undue delay. We don't have common law in Europe, EU is mostly civil law (emphasis on civil) or Romano-Germanic law. The only exception is Scandinavian law, which is very similar to (and a subgroup of) civil law anyway.

You clone the database and remove/update the corresponding lines. GDPR does not mean, you have to fix it right away, imho.

by okr 5y ago

You clone the database and remove/update the corresponding lines. GDPR does not mean, you have to fix it right away, imho.

gnabgib 5y ago

Article 17 does include the term "without undue delay"[0], but such vague language seems ripe for some court precedent. A clone and remove/update per GDPR request seems like undue delay, certainly one that could be avoided by alternative architecture choices (keep the personally identifiable information (PII) in a mutable store) [0]: https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/

deleted 5y ago
[deleted]
sigzero 5y ago
No, it's not undue delay. That's just how it currently works and that is a fine argument.

peoplefromibiza 5y ago

But you have to do in a pretty short timeframe > Under Article 12.3 of the GDPR, you have 30 days to provide information on the action your organization will decide to take on a legitimate erasure request. This timeframe can be extended up to 60 days depending on the complexity of the request. even if they ask for more time, first communication has to come within 30 days

topspin 5y ago
So, no deadline for the actual deletion? Your 'first communication' could say "your data will be deleted at some point between now and ten years from now" and be compliant?
- peoplefromibiza 5y ago
  No, it says: 30 days, maximum 60, if you need 60 you have to communicate it within the first 30 with a motivation. It looks pretty straightforward English to me. GDPR is published in 24 languages, including English, I don't know why people still don't get it and what's so hard to understand. It's not a single law, it's a collection of articles, the 17th says that data should be erased without undue delay. We don't have common law in Europe, EU is mostly civil law (emphasis on civil) or Romano-Germanic law. The only exception is Scandinavian law, which is very similar to (and a subgroup of) civil law anyway.