5 ms·
From a GDPR perspective, it also covers logs, internal training data etc. If a user requires to be deleted, you have to delete everything, there can be no trace
by peterjuras 5y ago
From a GDPR perspective, it also covers logs, internal training data etc. If a user requires to be deleted, you have to delete everything, there can be no trace of their existence.
- shadowgovt 5y agoThere's a reason many of us across the ocean look at that part of the GDPR like someone decided you could put the feathers back in the pillowcase if you just made it illegal for the feathers to be outside the pillowcase.
- that_guy_iain 5y agoGDPR, from what the legal trainings I've had, logs aren't covered if you apply the technical requirement and costs, etc.
- morelisp 5y agoThis also depends on if the data was sensitive and your log usage/retention policy, i.e. you can't just say "it's logs" to be able to keep things - you need to show you're only using them as logs. Addresses are sensitive information and whatever was happening sounds like multi-purpose-consent-necessary data processing and it was years old.
- oauea 5y ago> If a user requires to be deleted, you have to delete everything, there can be no trace of their existence. False. Transaction data must be kept for legal reasons and deletion requests do not apply to it.
- peterjuras 5y agoYep, that might be true for certain industries. But logs don't count as the transactional data that needs to be kept for legal reasons.
- oauea 5y agoThat depends entirely on what they're logging and why.
- layer8 5y agoThere are always time limits that apply, which means you need to have a process to delete the relevant log entries (or the whole log) eventually.
- oauea 5y agoSure, like 7 years. https://business.gov.nl/regulation/keeping-business-records/ https://business.gov.nl/regulation/keeping-business-records/