2 ms·

I would guess that there are quite a few limits to that... A user has a long history of participating on your forum and other users have quoted their messages

by afiori 4y ago

I would guess that there are quite a few limits to that... A user has a long history of participating on your forum and other users have quoted their messages far and wide. Collectively all of the messages posted on your forums (with or without timestamps) reveal a few PII about the user. Do you have to delete those? The user filed a bug report about a functionality not working, do you have to delete the text of the bug report? Arguably if your user table look like [user_id, creation_date, deletion_date, status, account_type] then this table does not contain any PII. Assuming that user content is not automatically PII, whose responsibility is it to track where PII can be? Sometimes users doxx themselves (like mistakenly sharing tax return forms instead cat pics), in such a case it is the user responsibility to signal this to you. If the user filed an issue saying "when I insert my name (Abe Cox) the input validation fails" is it you or the user that need to read through all the issues to find this case? My point is that GDPR + right to be forgotten cannot make it look like you never had an account at all, especially without user assistance.

hnbad 4y ago
user_id is PII if the identity of a user can be narrowed down sufficiently. For example, if you created a social media app and later left the company, it could still be determined that if you had an account it likely has one of the lowest user ID values if those were assigned sequentially. So even if your name was removed from it and none of your posts provided any identifying information about you, the user ID could still qualify as PII. Likewise if the user ID is public and non-PII content associated with that ID is linked elsewhere identifying the author of that content (e.g. a news article embedding a post) the identity of the author is still compromised. The problem is not just that users may submit PII in unexpected places, the problem is that even if the data type could not possibly allow them to, metadata beyond your control may actually still taint your supposedly anonymous data.
- afiori 4y ago
  The question is not whether "spooky deanonymization as a distance" is possible; the question is how much you should proactively do to avoid this. As an extreme example, if user A takes a screenshot if their own user setting page on a image sharing site, then sends it to user B that uploads it to the same site. Who is responsible for this piece of data? does share-a-pic.web need to scan all images for the username of a user that is deleting an account? This is a convoluted example where the answer is obviously no, but it shows that a purely principled answer might be unsuitable. Especially since non PII data you own mixed with non PII data someone else owns can become PII and you do not know what data others have. (you could also replace the user ID in all locations with a new tagged UUID to preserve referential integrity in the DB, but there not much more than 2^32 humans in total, it s very hard not to be deanonymizable)
alerighi 4y ago
> A user has a long history of participating on your forum and other users have quoted their messages far and wide. Collectively all of the messages posted on your forums (with or without timestamps) reveal a few PII about the user. Do you have to delete those? Technically yes. > The user filed a bug report about a functionality not working, do you have to delete the text of the bug report? Depends of the privacy policy of the bug tracking application. If it's stated that the report shouldn't contain any personal data you don't have to delete it. If the user asks for deletion stating that it contain personal data you have to delete it. > Arguably if your user table look like [user_id, creation_date, deletion_date, status, account_type] then this table does not contain any PII. It doesn't, as long you no longer have any way to associate user_id to the user personal data, you can keep it. > Sometimes users doxx themselves (like mistakenly sharing tax return forms instead cat pics), in such a case it is the user responsibility to signal this to you. In that situation if the user asks for deletion of the content you have to provide it. You are obviously not asked to monitor errors about the user.

by afiori 4y ago

hnbad 4y ago

user_id is PII if the identity of a user can be narrowed down sufficiently. For example, if you created a social media app and later left the company, it could still be determined that if you had an account it likely has one of the lowest user ID values if those were assigned sequentially. So even if your name was removed from it and none of your posts provided any identifying information about you, the user ID could still qualify as PII. Likewise if the user ID is public and non-PII content associated with that ID is linked elsewhere identifying the author of that content (e.g. a news article embedding a post) the identity of the author is still compromised. The problem is not just that users may submit PII in unexpected places, the problem is that even if the data type could not possibly allow them to, metadata beyond your control may actually still taint your supposedly anonymous data.

afiori 4y ago
The question is not whether "spooky deanonymization as a distance" is possible; the question is how much you should proactively do to avoid this. As an extreme example, if user A takes a screenshot if their own user setting page on a image sharing site, then sends it to user B that uploads it to the same site. Who is responsible for this piece of data? does share-a-pic.web need to scan all images for the username of a user that is deleting an account? This is a convoluted example where the answer is obviously no, but it shows that a purely principled answer might be unsuitable. Especially since non PII data you own mixed with non PII data someone else owns can become PII and you do not know what data others have. (you could also replace the user ID in all locations with a new tagged UUID to preserve referential integrity in the DB, but there not much more than 2^32 humans in total, it s very hard not to be deanonymizable)

alerighi 4y ago

> A user has a long history of participating on your forum and other users have quoted their messages far and wide. Collectively all of the messages posted on your forums (with or without timestamps) reveal a few PII about the user. Do you have to delete those? Technically yes. > The user filed a bug report about a functionality not working, do you have to delete the text of the bug report? Depends of the privacy policy of the bug tracking application. If it's stated that the report shouldn't contain any personal data you don't have to delete it. If the user asks for deletion stating that it contain personal data you have to delete it. > Arguably if your user table look like [user_id, creation_date, deletion_date, status, account_type] then this table does not contain any PII. It doesn't, as long you no longer have any way to associate user_id to the user personal data, you can keep it. > Sometimes users doxx themselves (like mistakenly sharing tax return forms instead cat pics), in such a case it is the user responsibility to signal this to you. In that situation if the user asks for deletion of the content you have to provide it. You are obviously not asked to monitor errors about the user.