3 ms·

Think about what the "Right to be forgotten" means at a technical level. It means you need to permanently delete records from your databases -- not just mark th

Think about what the "Right to be forgotten" means at a technical level. It means you need to permanently delete records from your databases -- not just mark them with a deleted flag as well as delete records from your backups and reports generated that may contain personal information. In addition your organization may also be held responsible for removal of data given to third parties. This is a big deal and it has many concerned over how it can be implemented as well as enforced.

alexro 14y ago
This means that the companies will not collect and maintain too much data about me to start with. There can be a reasonable amount of data - like name, DOB, address - that can stay public in any case. Other data will have to be deleted.
- patrickg 14y ago
  Any kind of personal data must stay privat unless I decide that can be revealed/public. Name, DOB, and address are personal data. I must have the right to prevent companies giving my address away (public or other companies).
  - alexro 14y ago
    That'd be the ideal scenario I suppose.
patrickg 14y ago
I believe that this is the current situation in Germany and I assume other E.U. countries.
- jnorthrop 14y ago
  It's debatable whether Germany's data protection laws include a right to be forgotten, but, in any case, it is not on the scale that is being proposed by the revised Data Directive. Other EU countries do not have the "right." What they do have, that exceeds protection in the US, is the right for many EU citizens to request a copy of all of the information a company has on an individual, as well as, in many cases, the requirement that a company gain explicit permission before collecting or sharing personal information.
  - ajuc 14y ago
    Poland also have it (right tu update and delete your data) since 1997. In practice it wasn't a problem (or at least no big complains). We had our share of social networks. About this law: http://www.privireal.org/content/dp/poland.php http://www.privireal.org/content/dp/poland.php
rbehrends 14y ago
No, this is not a "big deal", unless your company is already non-compliant with existing data protection laws. Article 12 of directive 95/46/EC [1] specifies: Member States shall guarantee every data subject the right to obtain from the controller: ... (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data; (c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort. Article 17 of the proposed regulation [2], a.k.a. the "the right to be forgotten/erasure" strengthens existing erasure/data minimization laws. You are already required to erase data upon request under certain circumstances, and under the circumstances described in article 17 (1) and existing law, you should no longer be storing the data to begin with. [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:... [2] http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf http://ec.europa.eu/justice/data-protection/document/review2...
estebank 14y ago
Encrypt row fields with a per user salt. Backup this salt separately from the rest of the data in an easier to access media. When deletion of a full row is needed, you just need to delete the salt from the comparatively smaller and quicker salt backups, as well as the live row+salt.

alexro 14y ago

This means that the companies will not collect and maintain too much data about me to start with. There can be a reasonable amount of data - like name, DOB, address - that can stay public in any case. Other data will have to be deleted.

patrickg 14y ago
Any kind of personal data must stay privat unless I decide that can be revealed/public. Name, DOB, and address are personal data. I must have the right to prevent companies giving my address away (public or other companies).
- alexro 14y ago
  That'd be the ideal scenario I suppose.

patrickg 14y ago

I believe that this is the current situation in Germany and I assume other E.U. countries.

jnorthrop 14y ago
It's debatable whether Germany's data protection laws include a right to be forgotten, but, in any case, it is not on the scale that is being proposed by the revised Data Directive. Other EU countries do not have the "right." What they do have, that exceeds protection in the US, is the right for many EU citizens to request a copy of all of the information a company has on an individual, as well as, in many cases, the requirement that a company gain explicit permission before collecting or sharing personal information.
- ajuc 14y ago
  Poland also have it (right tu update and delete your data) since 1997. In practice it wasn't a problem (or at least no big complains). We had our share of social networks. About this law: http://www.privireal.org/content/dp/poland.php http://www.privireal.org/content/dp/poland.php

rbehrends 14y ago

No, this is not a "big deal", unless your company is already non-compliant with existing data protection laws. Article 12 of directive 95/46/EC [1] specifies: Member States shall guarantee every data subject the right to obtain from the controller: ... (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data; (c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort. Article 17 of the proposed regulation [2], a.k.a. the "the right to be forgotten/erasure" strengthens existing erasure/data minimization laws. You are already required to erase data upon request under certain circumstances, and under the circumstances described in article 17 (1) and existing law, you should no longer be storing the data to begin with. [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:... [2] http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf http://ec.europa.eu/justice/data-protection/document/review2...

estebank 14y ago

Encrypt row fields with a per user salt. Backup this salt separately from the rest of the data in an easier to access media. When deletion of a full row is needed, you just need to delete the salt from the comparatively smaller and quicker salt backups, as well as the live row+salt.