3 ms·
Exactly! The logs only need to hold ID's that you can correlate back to hydrated data later. GDPR request comes in, just delete the record the ID refers to and
by llamaLord 2y ago
Exactly! The logs only need to hold ID's that you can correlate back to hydrated data later.
GDPR request comes in, just delete the record the ID refers to and you're done.
- unscaled 2y agoThis is not enough. First, as another reply above has mentioned, other data in the logs (such as IP address, list of friends, browser fingerprint) can be used to de-anonymize the pseudonymous ID. Second, GDPR makes it quite clear (for the reasons above) that pseudonymized data, is still considered personal data. Pseudonymization reduces the risks, but does not remove them entirely. It should generally be combined with other measures such as encryption.