3 ms·

> To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want. ...and then presumably deleting it, as require

by remus 2y ago

> To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want. ...and then presumably deleting it, as required by the law if there is no business or technical reason for having the personal data. That seems like a pretty good pro-privacy move, vs leaving that data hanging around forever.

kasey_junk 2y ago
It seems weird to me because I’m creating a capability that could be used to invade privacy when none would exist besides the compliance requirement.
- remus 2y ago
  It seems a net positive overall to me: the system has gone from collecting and storing personal info for no reason, with all the risk that entails (e.g. a data breach that exposes that info) to no longer storing that info (and hopefully no longer collecting it in the first place either). It seems to me like you've built an important auditing tool for picking up areas where the system as a whole was being loose with personal data. If the end goal is to improve privacy, not collecting and storing the data seems a much stronger protection than crossing your fingers hoping someone doesn't go rummaging around looking for personal data.
- p_l 2y ago
  Just because you do not yet have the capability to abuse the invasion of privacy you have already done, does not prevent you from doing so later. GDPR's goal was to make PII into "toxic materiel", to be only handled if you really, really need it and are willing to deal with the toxicity. Having a pool of toxic sludge and declaring everything is fine because you do not use it after filtering what was useful for you does not stop it from being a dangerous pool of toxic sludge.
- okanat 2y ago
  The only way _you_ can think of is "invading privacy". If you delete any data that can single out people when you're ingesting it, then nothing more needs to be done. So you delete any user identifying data by default, not keep it from the very start, unless you have a very strong use case. You can also have completely anonymised but still useful data. There are many statistical methods to collect useful but reasonably and provably anonymous data like differential privacy. If the businesses that give you data don't provide the option of completely deleting it then they are non-compliant as well.

by remus 2y ago

kasey_junk 2y ago

It seems weird to me because I’m creating a capability that could be used to invade privacy when none would exist besides the compliance requirement.

remus 2y ago
It seems a net positive overall to me: the system has gone from collecting and storing personal info for no reason, with all the risk that entails (e.g. a data breach that exposes that info) to no longer storing that info (and hopefully no longer collecting it in the first place either). It seems to me like you've built an important auditing tool for picking up areas where the system as a whole was being loose with personal data. If the end goal is to improve privacy, not collecting and storing the data seems a much stronger protection than crossing your fingers hoping someone doesn't go rummaging around looking for personal data.
p_l 2y ago
Just because you do not yet have the capability to abuse the invasion of privacy you have already done, does not prevent you from doing so later. GDPR's goal was to make PII into "toxic materiel", to be only handled if you really, really need it and are willing to deal with the toxicity. Having a pool of toxic sludge and declaring everything is fine because you do not use it after filtering what was useful for you does not stop it from being a dangerous pool of toxic sludge.
okanat 2y ago
The only way _you_ can think of is "invading privacy". If you delete any data that can single out people when you're ingesting it, then nothing more needs to be done. So you delete any user identifying data by default, not keep it from the very start, unless you have a very strong use case. You can also have completely anonymised but still useful data. There are many statistical methods to collect useful but reasonably and provably anonymous data like differential privacy. If the businesses that give you data don't provide the option of completely deleting it then they are non-compliant as well.