5 ms·
As long as all PII is purged in this process (tricky to guarantee with software like Confluence that is entirely dedicated to hosting user-generated data), that
by organsnyder 5y ago
As long as all PII is purged in this process (tricky to guarantee with software like Confluence that is entirely dedicated to hosting user-generated data), that could be compliant.
- Nextgrid 5y agoTechnically the foreign key relationships could themselves be considered identifying data.
- EdwardDiego 5y agoHow do you mean?
- Nextgrid 5y agoLet’s imagine you’re a modern bank and associate card transactions with the merchant. Even if you sanitize/delete the account holder record, you can’t delete the transactions themselves (as it would screw up your accounting) nor the merchant association. Now let’s say you have a very particular customer that always goes to a very specific restaurant at pretty much the same time every day consistently. That pattern alone is enough to single out that particular person (and deanonymize them by correlating with other records such as cell phone location data, etc).
- SheinhardtWigCo 5y agoIs this based on your interpretation of GDPR, or legal precedent?
- Nextgrid 5y agoThe former - my understanding is that anything that can be used to identify a user is considered personal data, so even things that would be benign/meaningless in isolation would count if they produce a unique enough signal when aggregated.
- michaelt 5y agoGiven that 99% of GDPR stuff goes unenforced, presumably it's the former. If you understand the GDPR exclusively based on legal precedent, you'd probably conclude the GDPR doesn't exist.
- barrkel 5y agoGDPR creates a legal liability. It's less about enforcement and more about litigation risk.
- Nextgrid 5y agoThe risk is very minimal or non-existent in the current situation though. Maybe once Google or Facebook is properly fined (with those 4% fines everyone was fear-mongering about) then you'll have to reevaluate, but given how it's gone so far I can't see that happening ever.
- Xylakant 5y agoA bank would entirely be entitled to keep the info around. All information that must be retained by law (such as receipts, financial transactions etc.) is exempt from the GDPR and you cannot ask for deletion. You can ask that the holder of that information does not use it for purposes other than the ones covered by law, but that’s the full extend of it.
- spacebanana7 5y agoThe same principal about foreign key relationships could be applied to messaging apps, restaurant booking services or anything else where a user's relationships with other entities/users would allow them to be identified.
- Xylakant 5y agoThe posting I responded to was about a case where the transactions themselves cannot be deleted since they must be retained for accounting reasons, so the same reasoning applies here: If they need to retain the messages/bookings/... for legal/accounting reasons, then they're exempt. If they don't need to retain them, they can just delete them.
- spacebanana7 5y agoThe banking example was a bit muddled because it mixed the necessity of deletion with the method of deletion. Wherever possible a business should delete relational data upon request. However, relational data is special because it cannot be effectively deleted by overriding user data with random values as Confluence seems to do. Even if banks were allowed to delete customer data, they would face the same problem as social or booking services in that their relational data must be truly 'removed' rather than just overridden.
- koblas 5y agoBanks are also regulated by financial crime regulations, which take presence over GDPR. There is an obligation to preserve data for a period of time (years) for this purpose.
- EdwardDiego 5y agoAh yep, thought that was the case, thanks for clarifying :)
- warmwaffles 5y agoI wonder if they also go through all of their backups and purge the PII. I would be willing to bet, they don't.
- hobs 5y agoNot required by the GDPR... so they will not.
- c0balt 5y agoBackups usually have limited retention after various data protection agencies. In my current location the recommended time is a few weeks for backups, a few days for logs etc. Those agencies are fully aware that nobody goes around purging data from backups (which may also be hard with airgapped backups etc.) and you might need to wait before being "forgotten".
- DelightOne 5y agoAre they allowed to restore the account from backup if the user asks for the reopening of the account?
- hvidgaard 5y agoYou only need to state to what extend and period the information is stored in backups, and have a process in place to purge it again in case of a restore.
- warmwaffles 5y agoI never realized that was the rule. I thought you had to go in and wipe the backups regularly.
- hvidgaard 5y agoThat would be infeasible for cold storage.