3 ms·

Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time. As soon as a mechanism

by btown 3y ago

Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time. As soon as a mechanism to overwrite all existing records (or, equivalently, to destroy the keys necessary to decrypt those records) exists, a sufficiently determined hacker/ransomeer will be able to compromise that mechanism. Paper, at least in theory, requires noticeable human action to achieve destruction at similar scale. One hopes, of course, that the environmental controls of the archival facilities aren't cloud connected... [0] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

pmontra 3y ago
GDPR doesn't apply to the UK but one of the provisions of GDPR is that it does not apply to deceased people. Recital 27: "This Regulation does not apply to the personal data of deceased persons" Article 17 is "Right to erasure (‘right to be forgotten’)" and even without Recital 27 a deceased person cannot ask anything anymore.
- multjoy 3y ago
  It very much does apply to the UK.
  - PrimeMcFly 3y ago
    How?
    - pmontra 3y ago
      When managing data of EU citizens, but does it still apply to UK companies managing data of UK citizens in the UK?
      - PrimeMcFly 3y ago
        EU asserts extrajudicial authority but it's pretty meaningless. Can't see why it would apply to UK citizens in the UK at all.
        pmontra 3y ago
        > EU asserts extrajudicial authority but it's pretty meaningless They can prevent a company to operate in the EU and/or fine them. > Can't see why it would apply to UK citizens in the UK at all. Exactly.
- extraduder_ire 3y ago
  Did they repeal it after the withdrawal finalized or something? IIRC, it was granted ascent long before they left the EU.
jdietrich 3y ago
>Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time. No. There are many exemptions to the Article 17 right to erasure, including a specific exemption for historical archives. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/

by btown 3y ago

pmontra 3y ago

GDPR doesn't apply to the UK but one of the provisions of GDPR is that it does not apply to deceased people. Recital 27: "This Regulation does not apply to the personal data of deceased persons" Article 17 is "Right to erasure (‘right to be forgotten’)" and even without Recital 27 a deceased person cannot ask anything anymore.

multjoy 3y ago
It very much does apply to the UK.
- PrimeMcFly 3y ago
  How?
  - pmontra 3y ago
    When managing data of EU citizens, but does it still apply to UK companies managing data of UK citizens in the UK?
    - PrimeMcFly 3y ago
      EU asserts extrajudicial authority but it's pretty meaningless. Can't see why it would apply to UK citizens in the UK at all.
      - pmontra 3y ago
        > EU asserts extrajudicial authority but it's pretty meaningless They can prevent a company to operate in the EU and/or fine them. > Can't see why it would apply to UK citizens in the UK at all. Exactly.
extraduder_ire 3y ago
Did they repeal it after the withdrawal finalized or something? IIRC, it was granted ascent long before they left the EU.

jdietrich 3y ago

>Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time. No. There are many exemptions to the Article 17 right to erasure, including a specific exemption for historical archives. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/