6 ms·

Someone either never worked with b2b, LEA or UGC... Someone breaks community rules and bullies someone or something similar, they delete their comments. What

by 0x457 3y ago

Someone either never worked with b2b, LEA or UGC... Someone breaks community rules and bullies someone or something similar, they delete their comments. What do you do now? Business customers expect that everything they delete is possible to restore, even if the delete button clearly says, "this action is irreversible". Law Enforcement Agencies would expect you to be able to pull data from them as well.

miki123211 3y ago
On the other hand, other law enforcement agencies explicitly require that kind of data to be deleted, especially when the GDPR is concerned.
- 0x457 3y ago
  Well, it's not that simple. Even GDPR has circumstances where "Right to be forgotten" aren't applied. Even when it does apply, it must be done without "undue delay". Which is about a month. Some of them are: - "Establishment, exercise or defence of legal claims" - "Compliance with a legal obligation, the performance of a task carried out in the public interest or in the exercise of official authority." In my B2B product, I do soft-deletes, but there is a task that cleans up deleted records older than N days at a specified interval.
jackvalentine 3y ago
> Law Enforcement Agencies would expect you to be able to pull data from them as well. A previous lifetime of mine was ensuring that when we legally were able to delete things we _really deleted them_ from _all the places they ended up including backups_ to ensure our response to subpoenas, LEOs, regulatory bodies and other busybodies was 'Unfortunately information about that customer was deleted on <date> under <legal authority>. We have no data to provide you'.
- 0x457 3y ago
  That's one way to deal with it. We didn't want CP to be freely exchanged on our platform. I think unless you're operating a very privacy focused business where such privacy is the selling point - there is no harm in complying.
  - jackvalentine 3y ago
    > I think unless you're operating a very privacy focused business where such privacy is the selling point - there is no harm in complying. Disagree completely - giving access to data to LEOs (or others) that you have no ongoing business use for only has downsides and has zero upsides. I have made several submissions to judges stating the date and for what reason we destroyed records and every time the answer has been ‘well, you were legally entitled to’ and the cases were dismissed early on. It is especially difficult in modern times to enact, but my personal view is shred fast and shred often with everything.

by 0x457 3y ago

miki123211 3y ago

On the other hand, other law enforcement agencies explicitly require that kind of data to be deleted, especially when the GDPR is concerned.

0x457 3y ago
Well, it's not that simple. Even GDPR has circumstances where "Right to be forgotten" aren't applied. Even when it does apply, it must be done without "undue delay". Which is about a month. Some of them are: - "Establishment, exercise or defence of legal claims" - "Compliance with a legal obligation, the performance of a task carried out in the public interest or in the exercise of official authority." In my B2B product, I do soft-deletes, but there is a task that cleans up deleted records older than N days at a specified interval.

jackvalentine 3y ago

> Law Enforcement Agencies would expect you to be able to pull data from them as well. A previous lifetime of mine was ensuring that when we legally were able to delete things we _really deleted them_ from _all the places they ended up including backups_ to ensure our response to subpoenas, LEOs, regulatory bodies and other busybodies was 'Unfortunately information about that customer was deleted on <date> under <legal authority>. We have no data to provide you'.

0x457 3y ago
That's one way to deal with it. We didn't want CP to be freely exchanged on our platform. I think unless you're operating a very privacy focused business where such privacy is the selling point - there is no harm in complying.
- jackvalentine 3y ago
  > I think unless you're operating a very privacy focused business where such privacy is the selling point - there is no harm in complying. Disagree completely - giving access to data to LEOs (or others) that you have no ongoing business use for only has downsides and has zero upsides. I have made several submissions to judges stating the date and for what reason we destroyed records and every time the answer has been ‘well, you were legally entitled to’ and the cases were dismissed early on. It is especially difficult in modern times to enact, but my personal view is shred fast and shred often with everything.