3 ms·
Uber really needs to have a public data retention policy stating that they anonymize or delete all data older than a couple weeks. I'm just waiting for them to
by berberous 12y ago
Uber really needs to have a public data retention policy stating that they anonymize or delete all data older than a couple weeks. I'm just waiting for them to be hacked and have to reveal that people's trip data for years has been released.
- dredmorbius 12y agoNot just Uber. Obama's proposing data privacy regulations. I think it's worth considering what you'd like to see involved in same.
- paulannesley 12y agoMeanwhile, Australia is about to legislate mandatory data retention :( https://stopthespies.org/ https://stopthespies.org/
- rietta 12y agoA data retention policy can state that you delete all non-operational data after 60 or 90 days. Or that it is moved to one-way encrypted storage for up to a year. In other words, it can be a security mechanism vs "we keep everything in the SQL database, forever" that tends to be the default in many circumstances.
- rietta 12y agoIt's definitely not just Uber. And drivers' license numbers are serious PII! It was my exact example that I gave to my last appsec talk for Ruby developers this month in Nashville. Starting with the user story: "As a Pawn Shop Clerk, I scan a copy of the customer’s drivers’ license because the company is required by law to keep this record at least two years from the date we purchase a used valuable from a customer." https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s There was a good Q&A about data retention, that included a lawyer in the audience.