4 ms·

Stop spreading misinformation. Nobody is required to hard delete the very second the [delete] button is pressed. You're following the law as long as that mentio

Stop spreading misinformation. Nobody is required to hard delete the very second the [delete] button is pressed. You're following the law as long as that mentioned reaper job exists and runs at least once per month, to be safely within the allowed timeframe

brigandish 4y ago
I didn't see a claim that deletion had to be "the very second the [delete] button is pressed". This is the actual text of the law[1]: > The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay There is a one month limit of the right of access[2] and right to be informed[3], which flow into some of the articles of the law; and certain articles also mention a month's limit on being informed, e.g. from article 12 parts 3 and 4 [4]: > The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject *without undue delay and in any event within one month* of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. I've marked out those phrases because they show the language of the law that you will see again and again in the articles - without undue delay and within one month. The latter does not obviate the former. Hence, and in fact, there is no part of the law that explicitly gives you a month to delete something. If you could delete something right now but you leave it hanging around because you have arbitrarily chosen a job to run once a month and there's a leak in that time, that would be undue delay. [1] https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ [2] https://gdpr-info.eu/issues/right-of-access/ https://gdpr-info.eu/issues/right-of-access/ [3] https://gdpr-info.eu/issues/right-to-be-informed/ https://gdpr-info.eu/issues/right-to-be-informed/ [4] https://gdpr-info.eu/art-12-gdpr/ https://gdpr-info.eu/art-12-gdpr/
- 411111111111111 4y ago
  You literally said that soft deletes are illegal, which heavily implies what you now deny to have said. The 30 days wasn't particularly taken from the regulation, the actual grace period for the deletion should be 90 days in total, but I'm not a lawyer nor certain about it. What I am certain about is that your original thesis, which is soft deletes being illegal under gdpr, is complete bullshit
  - brigandish 4y ago
    > You literally said that soft deletes are illegal, which heavily implies what you now deny to have said. Who is "you" here? Perhaps if you were less defensive you'd notice that I'm not the person you originally replied to, which, by the way, makes your response nonsensical. Edit: I'll add, that the only person who is likely to get anywhere near to "complete bullshit" is going to be the one who writes "but I'm not a lawyer nor certain about it" and doesn't provide a shred of evidence to back up their, frankly completely ignorant, notions. 90 days grace? Risible.
    - 411111111111111 4y ago
      Yeh, you take first place for the most retarded person 2022 award.
- pbreit 4y ago
  The user has to explicitly request the erasure.
  - brigandish 4y ago
    Yes, they do that by pressing the delete button on their side (and so forth). This is covered in the first line "The data subject shall have the right to obtain". If you want to go to court and argue that the user should've know that pressing a big red button with "DELETE!" on it really means soft delete, be my guest.

brigandish 4y ago

I didn't see a claim that deletion had to be "the very second the [delete] button is pressed". This is the actual text of the law[1]: > The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay There is a one month limit of the right of access[2] and right to be informed[3], which flow into some of the articles of the law; and certain articles also mention a month's limit on being informed, e.g. from article 12 parts 3 and 4 [4]: > The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject *without undue delay and in any event within one month* of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. I've marked out those phrases because they show the language of the law that you will see again and again in the articles - without undue delay and within one month. The latter does not obviate the former. Hence, and in fact, there is no part of the law that explicitly gives you a month to delete something. If you could delete something right now but you leave it hanging around because you have arbitrarily chosen a job to run once a month and there's a leak in that time, that would be undue delay. [1] https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ [2] https://gdpr-info.eu/issues/right-of-access/ https://gdpr-info.eu/issues/right-of-access/ [3] https://gdpr-info.eu/issues/right-to-be-informed/ https://gdpr-info.eu/issues/right-to-be-informed/ [4] https://gdpr-info.eu/art-12-gdpr/ https://gdpr-info.eu/art-12-gdpr/

411111111111111 4y ago
You literally said that soft deletes are illegal, which heavily implies what you now deny to have said. The 30 days wasn't particularly taken from the regulation, the actual grace period for the deletion should be 90 days in total, but I'm not a lawyer nor certain about it. What I am certain about is that your original thesis, which is soft deletes being illegal under gdpr, is complete bullshit
- brigandish 4y ago
  > You literally said that soft deletes are illegal, which heavily implies what you now deny to have said. Who is "you" here? Perhaps if you were less defensive you'd notice that I'm not the person you originally replied to, which, by the way, makes your response nonsensical. Edit: I'll add, that the only person who is likely to get anywhere near to "complete bullshit" is going to be the one who writes "but I'm not a lawyer nor certain about it" and doesn't provide a shred of evidence to back up their, frankly completely ignorant, notions. 90 days grace? Risible.
  - 411111111111111 4y ago
    Yeh, you take first place for the most retarded person 2022 award.
pbreit 4y ago
The user has to explicitly request the erasure.
- brigandish 4y ago
  Yes, they do that by pressing the delete button on their side (and so forth). This is covered in the first line "The data subject shall have the right to obtain". If you want to go to court and argue that the user should've know that pressing a big red button with "DELETE!" on it really means soft delete, be my guest.