2 ms·

I worked for a company that made games that were used by young children and so covered by COPA. They definitely took a lot of care to delete everything.

andrei_says_ 5y ago
How are backups dealt with in this scenario?
- d2wa 5y ago
  The practice developed around the GDPR looks something like this: You keep a separate record of deleted accounts. If you ever need to use or restore from backups, you need to filter the import or other use against that list. You can only do data-integrity checks against the backups and not use it for any purpose, of course. You must notify your local data protection authority if there are any exceptions. Like, if you restored a backup but you can't guarantee that deleted accounts remains deleted. In other words, you don't need to wipe backups but you can't use them without processes in place to ensure you comply with your customers' rights granted under the GDPR.
  - bluehatbrit 5y ago
    How does this line up with something like a data breach of a backup?
    - Sayrus 5y ago
      In this case, you would still leak the data you had on the user. In France, according to the CNIL's recommendation, you can keep users' data in backups but you have to notify in clear words them that their data is kept X years. As a side note, the CNIL also clarified things the author have issues with, for instance "without undue delay" is set to 30 days. In the UK, I've read they backups for specific users must be deleted when technically possible. I'm not sure how that works in practice.
- Terry_Roll 5y ago
  Backups are not even processed under the UK GDPR when people want data wiped! Put another way do you see any backup service/software advertising the ability to wipe data from backups to conform with GDPR DSAR requests? Its virtually impossible with existing tech services and legislators, law enforcement and the like are covering this up!

andrei_says_ 5y ago

How are backups dealt with in this scenario?

d2wa 5y ago
The practice developed around the GDPR looks something like this: You keep a separate record of deleted accounts. If you ever need to use or restore from backups, you need to filter the import or other use against that list. You can only do data-integrity checks against the backups and not use it for any purpose, of course. You must notify your local data protection authority if there are any exceptions. Like, if you restored a backup but you can't guarantee that deleted accounts remains deleted. In other words, you don't need to wipe backups but you can't use them without processes in place to ensure you comply with your customers' rights granted under the GDPR.
- bluehatbrit 5y ago
  How does this line up with something like a data breach of a backup?
  - Sayrus 5y ago
    In this case, you would still leak the data you had on the user. In France, according to the CNIL's recommendation, you can keep users' data in backups but you have to notify in clear words them that their data is kept X years. As a side note, the CNIL also clarified things the author have issues with, for instance "without undue delay" is set to 30 days. In the UK, I've read they backups for specific users must be deleted when technically possible. I'm not sure how that works in practice.
Terry_Roll 5y ago
Backups are not even processed under the UK GDPR when people want data wiped! Put another way do you see any backup service/software advertising the ability to wipe data from backups to conform with GDPR DSAR requests? Its virtually impossible with existing tech services and legislators, law enforcement and the like are covering this up!