6 ms·

As long as the blockchain doesn't have "personally identifiable data" you're fine. When a web service is requested to "delete your data", all they need to dele

As long as the blockchain doesn't have "personally identifiable data" you're fine. When a web service is requested to "delete your data", all they need to delete is your name, email, phone etc. and still keep your activity data.

chaosite 5y ago
That's really not how GDPR works. If it's possible to derive PII from some other data (like activity data), then it's also considered PII under GDPR. And it's definitely possible to derive PII from activity data.
- ComradePhil 5y ago
  You can fight what is PII in European courts. I'm just saying how things actually work. When a company deletes you as a user under GDPR, it does not delete your purchase history for example, because it needs to link the transaction that happened, what was sold, for how much, from which merchant etc. Just because you ask to delete your data does not mean everything associated with you is deleted. The merchant for example will still need to see that the item was sold to someone for a given price etc. That data was not just "yours".
  - hobofromabroad 5y ago
    That's because there are other legal reasons to keep that kind of data. But that isn't a reason to keep all kinds of data related to a user account. Monetary transactions, claim data for insurances, but not support requests for instance.
    - ComradePhil 5y ago
      Support requests can be kept as long as you anonymize them. This is true for everything else. Look up "GDPR anonymyzation".
      - eivarv 5y ago
        Yes, if you mean true anonymization – i.e. not pseudonymization (e.g. replacing names with a pseudonym) or in any other way retaining personal data (internal identifiers, usage patterns or attributes that combined result in a unique enough fingerprint to identify a specific person, etc.)
  - chaosite 5y ago
    Why does it need to link the transaction that happened to a specific account? They certainly need to keep inventory records, but it's enough to note that an item was sold without linking that to a specific account. Are we using different definitions of the term "purchase history"? To me, that means a list of purchases by a single person. You can derive PII from that, so that's a no-no under GDPR. If you just have transaction records but can't group them by customer, then that's (probably) fine. Also note that sometimes you're legally required to keep PII for a certain amount of time, e.g., invoices with PII for tax reasons. GDPR says that's fine but you have to keep them for no longer than needed.
    - ComradePhil 5y ago
      > Also note that sometimes you're legally required to keep PII for a certain amount of time I'm not talking about legal reasons. You can keep the data regardless for any purposes as long as you remove the "personally identifiable information". For example, you will be required to remove their exact address but you can replace that with the general area (eg. post code) as a part of your anonymization.
yoavm 5y ago
I don't see anything so specific as "personally identifiable data". The GDPR Article 17 says all personal data. What makes you think activity data is fine to keep?
- ComradePhil 5y ago
  Look up "GDPR pseudonymization".
  - yoavm 5y ago
    Thanks, I have. The first result on Google[0] says that pseudonymized data is still considered personal data. [0] https://dataprivacymanager.net/pseudonymization-according-to-the-gdpr/ https://dataprivacymanager.net/pseudonymization-according-to...
    - ComradePhil 5y ago
      Yes, pseudonymization is reversible because you keep the PII separate from the rest of the data associated with the user. The reason you pseudonymize in the first place is that you can delete the PII part, after which the data becomes anonymized, which you can keep.
      - chaosite 5y ago
        That's incorrect. If the psuedonymized data is enough to fingerprint a specific individual (maybe with some additional data), the GDPR says you still can't keep it.
        ComradePhil 5y ago
        Correct! Which is why you need to pseudonymize correctly.
        yoavm 5y ago
        Good luck truly anonymizing the activity feed of any user on any social network. Good luck anonymizing support tickets that include stuff like "I'm running this version, on this device, and trying to do that". Good luck anonymizing messages between users that includes nicknames. Blockchain is such a terrible idea because even if today you're thinking "Well, I guess storing X is fine, it can't identify a user", tomorrow you might learn that it can. And there will be nothing you could do about it. And we haven't even started talking about bugs, which all software has (including DAOs and smart contracts...), that might cause you to store stuff on the chain, publicly and irreversibly. The future is going to be fun!
NGRhodes 5y ago
For GDPR, that could not be enough. If the data you hold can be used to indirectly identify someone, that information is subject to GDPR. The main example is when information can is combined with other information that allows individuals to be identified.
Hendrikto 5y ago
The GDPR very broadly defines ”personal data“ as: data relating to an identified or identifiable natural person. So no, deleting you name but keeping your activity data is not sufficient.

chaosite 5y ago

That's really not how GDPR works. If it's possible to derive PII from some other data (like activity data), then it's also considered PII under GDPR. And it's definitely possible to derive PII from activity data.

ComradePhil 5y ago
You can fight what is PII in European courts. I'm just saying how things actually work. When a company deletes you as a user under GDPR, it does not delete your purchase history for example, because it needs to link the transaction that happened, what was sold, for how much, from which merchant etc. Just because you ask to delete your data does not mean everything associated with you is deleted. The merchant for example will still need to see that the item was sold to someone for a given price etc. That data was not just "yours".
- hobofromabroad 5y ago
  That's because there are other legal reasons to keep that kind of data. But that isn't a reason to keep all kinds of data related to a user account. Monetary transactions, claim data for insurances, but not support requests for instance.
  - ComradePhil 5y ago
    Support requests can be kept as long as you anonymize them. This is true for everything else. Look up "GDPR anonymyzation".
    - eivarv 5y ago
      Yes, if you mean true anonymization – i.e. not pseudonymization (e.g. replacing names with a pseudonym) or in any other way retaining personal data (internal identifiers, usage patterns or attributes that combined result in a unique enough fingerprint to identify a specific person, etc.)
- chaosite 5y ago
  Why does it need to link the transaction that happened to a specific account? They certainly need to keep inventory records, but it's enough to note that an item was sold without linking that to a specific account. Are we using different definitions of the term "purchase history"? To me, that means a list of purchases by a single person. You can derive PII from that, so that's a no-no under GDPR. If you just have transaction records but can't group them by customer, then that's (probably) fine. Also note that sometimes you're legally required to keep PII for a certain amount of time, e.g., invoices with PII for tax reasons. GDPR says that's fine but you have to keep them for no longer than needed.
  - ComradePhil 5y ago
    > Also note that sometimes you're legally required to keep PII for a certain amount of time I'm not talking about legal reasons. You can keep the data regardless for any purposes as long as you remove the "personally identifiable information". For example, you will be required to remove their exact address but you can replace that with the general area (eg. post code) as a part of your anonymization.

yoavm 5y ago

I don't see anything so specific as "personally identifiable data". The GDPR Article 17 says all personal data. What makes you think activity data is fine to keep?

ComradePhil 5y ago
Look up "GDPR pseudonymization".
- yoavm 5y ago
  Thanks, I have. The first result on Google[0] says that pseudonymized data is still considered personal data. [0] https://dataprivacymanager.net/pseudonymization-according-to-the-gdpr/ https://dataprivacymanager.net/pseudonymization-according-to...
  - ComradePhil 5y ago
    Yes, pseudonymization is reversible because you keep the PII separate from the rest of the data associated with the user. The reason you pseudonymize in the first place is that you can delete the PII part, after which the data becomes anonymized, which you can keep.
    - chaosite 5y ago
      That's incorrect. If the psuedonymized data is enough to fingerprint a specific individual (maybe with some additional data), the GDPR says you still can't keep it.
      - ComradePhil 5y ago
        Correct! Which is why you need to pseudonymize correctly.
        yoavm 5y ago
        Good luck truly anonymizing the activity feed of any user on any social network. Good luck anonymizing support tickets that include stuff like "I'm running this version, on this device, and trying to do that". Good luck anonymizing messages between users that includes nicknames. Blockchain is such a terrible idea because even if today you're thinking "Well, I guess storing X is fine, it can't identify a user", tomorrow you might learn that it can. And there will be nothing you could do about it. And we haven't even started talking about bugs, which all software has (including DAOs and smart contracts...), that might cause you to store stuff on the chain, publicly and irreversibly. The future is going to be fun!

NGRhodes 5y ago

For GDPR, that could not be enough. If the data you hold can be used to indirectly identify someone, that information is subject to GDPR. The main example is when information can is combined with other information that allows individuals to be identified.

Hendrikto 5y ago

The GDPR very broadly defines ”personal data“ as: data relating to an identified or identifiable natural person. So no, deleting you name but keeping your activity data is not sufficient.