5 ms·

Right to be forgotten has some really nasty edge csaes.

• yoaviram 3y ago
  Such as?
  • jay_kyburz 3y ago
    such as the ability easily support redaction of personal data? Errg: sorry folks. I miss read the thread and thought the "such as" was responding to the comment next to it about the design flaw of not being able to delete personal data.
    • deleted 3y ago
      [deleted]
    • amanaplanacanal 3y ago
      That doesn’t sound like an edge case.
    • friendlyHornet 3y ago
      And this is nasty because?
    • seanhunter 3y ago
      That's not an edge case in the law, that's a limitation in your system.
  • Reubend 3y ago
    - Payments, particularly from P2P transactions. If I send you money, and then you request the deletion of your profile, there's plenty of complexity there. - Enforcement records from illegal content / violating content - Local data cache for offline mode in mobile apps I'm not saying all of these apply to "Threads". But there are tons of edge cases to consider that need code changes t o behave as expected.
    • 8fingerlouie 3y ago
      > Payments There's really no complexity there. The right to be forgotten doesn't superseed other laws, and it is required by law in most countries, that transaction data be stored for 5 years plus running year, so in case you request to be forgotten, that can only happen once the mandatory data retainment has expired, which can easily be handled by a "transaction date", and simply run a batch job that matches each user to their transactions (and desire to be forgotten), and once transaction are expired and the user has requested to be forgotten, you simply delete. > Local data cache for offline mode in mobile apps The right to be forgotten has a "grace period", so set your cache expiration to less than that amount of time and you're pretty much home safe, or better yet, don't cache GDPR sensitive data and you can pretty much cache for as long as you like.
      • spacebanana7 3y ago
        There's a lot more to payments than raw transaction data. Payments are usually related to the exchange of goods or services. The delivery data of those could be essential for winning a chargeback dispute or a liability for a customer that asked to be forgotten.
        • jen20 3y ago
          You aren’t holding raw transaction data on the basis of consent, so it doesn’t matter.
• _cenw 3y ago
  If your app doesn't easily support redaction of personal data, you have a design flaw to fix.
  • Silhouette 3y ago
    How are you going to "fix" that "design flaw" when the personal data in question is the result of legally required customer age checks? Evidence needed to support your tax filings? Used to identify and block people who are repeatedly trying to defraud you or breach your security? Subject to a legal hold because it might provide relevant evidence in some legal action between other parties or it's been requested as evidence by some government committee? Data protection laws like the GDPR might take the position that you should minimise the collection and use of personal data. Many of us might even agree with that position in principle. It can still be complicated to work out what "minimal" actually means if you did have good reasons to collect the personal data in the first place and you might still need to keep the data or some part of it for those purposes or to comply with other laws or regulations.
    • _cenw 3y ago
      I don't know where your actual problem is. The GDPR allows holding data for most of these purposes. You intermingled legal obligations with data legal departments would like to hold in the end there. Only one of those is required. Also, some of these are pure theoretical in the EU. You're not even allowed to photocopy an ID in Germany; age verification is a checkmark someone sets upon verifying the ID is valid and then (metaphorically) handing it back, not a copy of a legal document that you probably don't want deduplicated to random S3 buckets held by all the companies you do business with. They're not exactly resistant to replay attacks, after all.
      • Silhouette 3y ago
        I don't know where your actual problem is. My point is that knowing which personal data you need to redact and under which circumstances is not always easy. Before you can build a system that does something you first need to identify exactly what something is required.
• elefanten 3y ago
  Can you elaborate a full argument here? Or link somewhere that does?
  • pinkcan 3y ago
    politicians and other shady individuals know how to use this to their advantage