4 ms·

I work at one of the largest, and have also worked at startups and in between. Having PII littered about in ways that aren’t easily deletable is quite a canary

I work at one of the largest, and have also worked at startups and in between. Having PII littered about in ways that aren’t easily deletable is quite a canary. Companies with these issues are the same companies that end up with data breaches due to their cavalier treatment of user data. Perhaps these companies should be grateful they have a regulatory body ensuring they don’t fall too far behind the basic data stewardship practices the rest of the industry has in place.

happytiger 3y ago
Not sure why this is being downvoted. It’s precisely these companies that haven’t architected their systems well or prioritized the safety and security of PII by littering it about in various systems and making it “undeletable” in their processes, that need a swift kick in the ass to get it together. I can’t believe people consider the argument that because companies have poorly managed systems and PII centered databases with no abstraction (and therefore are working right on actual customer record data in their data lakes), that this is somehow a viable argument for why we shouldn’t make deleting data possible. Companies like this are the next Equifax. Why would you condone their stupidity?
- johndhi 3y ago
  Translation of your comment: you believe legal requirements around data deletion will reduce the risk of data breach and therefore are good. My pov: maybe, but the cost isn't worth the benefit of doing it this way.
  - happytiger 3y ago
    Agree. My argument is more along the lines of, “the companies that aren’t prepared for this are the ones who most desperately need to clean up their act in the first place, cost aside.” But I’m inarticulate and do understand your reasoned point.
bob1029 3y ago
> Having PII littered about in ways that aren’t easily deletable is quite a canary. "We can't figure out how to delete PII" and "Our schema is flexible" are the same canary in my view. Everything goes back to founders & business owner giving enough of a shit to force a good architecture from the beginning. You can't build an effective schema to store complex information if your mission isn't clear yet. If concerns over PII storage are "we'll worry about that later", then whatever schema is invented from that point will mirror that vision. If the vision is "PII == high-level radioactive waste", then the resulting schema may not even offer places to store it, outside of specially-controlled tables.

happytiger 3y ago

Not sure why this is being downvoted. It’s precisely these companies that haven’t architected their systems well or prioritized the safety and security of PII by littering it about in various systems and making it “undeletable” in their processes, that need a swift kick in the ass to get it together. I can’t believe people consider the argument that because companies have poorly managed systems and PII centered databases with no abstraction (and therefore are working right on actual customer record data in their data lakes), that this is somehow a viable argument for why we shouldn’t make deleting data possible. Companies like this are the next Equifax. Why would you condone their stupidity?

johndhi 3y ago
Translation of your comment: you believe legal requirements around data deletion will reduce the risk of data breach and therefore are good. My pov: maybe, but the cost isn't worth the benefit of doing it this way.
- happytiger 3y ago
  Agree. My argument is more along the lines of, “the companies that aren’t prepared for this are the ones who most desperately need to clean up their act in the first place, cost aside.” But I’m inarticulate and do understand your reasoned point.

bob1029 3y ago

> Having PII littered about in ways that aren’t easily deletable is quite a canary. "We can't figure out how to delete PII" and "Our schema is flexible" are the same canary in my view. Everything goes back to founders & business owner giving enough of a shit to force a good architecture from the beginning. You can't build an effective schema to store complex information if your mission isn't clear yet. If concerns over PII storage are "we'll worry about that later", then whatever schema is invented from that point will mirror that vision. If the vision is "PII == high-level radioactive waste", then the resulting schema may not even offer places to store it, outside of specially-controlled tables.