Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are you implementing GDPR-compliant soft deletes?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#31

Post by rimeice »

It may be that the future issues you envisage can still be met with anonymous data i.e. some overall audit of your service use. Anonymous data retains a small link to the original but is exempt from GDPR. One method is to generalise records in a database, for example, mask / remove direct identifiers like names, put ages in to age brackets and fuzz spatial data by x distance. So this can be used to deal with erasure subject access requests and sharing data in general. There's a lot of advice on this from the ICO - https://ico.org.uk/media/1061/anonymisation-code.pdf

Disclaimer: I'm a fan of anonymisation because I'm working on a project to bundle this in to a service - https://anon.ai - would be great to understand more about your use case.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#32

Post by devdad »

CamperBob2 wrote: post #23
chesimov wrote: post #6

What would be the sort of dispute you envisage?

Government: "You know that data you were required to delete when $(USER) requested to be forgotten? We require you to provide it in connection with our ongoing investigation of $(USER)."

Is this a real issue though? If I comply to regulations to remove data as required by law, I'd be surprised if a government body could require me to provide data I am supposed to have deleted.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#33

Post by jacquesm »

eb0la wrote: post #26

Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…

I'm going to go out on a limb here and guess that 99% of the companies out there affected by the GDPR and the OP in particular do not have a DPO (yet), and may not realize they need one, and even if they do know that then they likely won't be able to fill the seat either in time or with someone competent.

Every year we look at quite a few companies, this is the first year that I've spotted a DPO in the wild, and impressively, they even knew their stuff.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#34

Post by jacquesm »

jjoergensen wrote: post #5

Deletion of backup-data is also an interesting topic

Spot on. There are two major issues with the law as written, backups and conflicts with (possibly local) data retention laws, so right now the local data retention laws will likely take precedence and backups are not going to be in-scope until a lot of low hanging fruit has been plucked.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#35

Post by jacquesm »

Kiro wrote: post #19
jjoergensen wrote: post #5

Deletion of backup-data is also an interesting topic

I won't touch my backups even if it means my company is killed by fines or I go to jail. Still worth it just to refuse submitting to this nonsense.

It's not nonsense, it just isn't quite put down in a way that is practical, on top of that it just makes demands and does not even begin to give guidance on how to comply with those demands which does not help for smaller companies.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#38

Post by jacquesm »

no1youknowz wrote: post #36

About the GDPR, can anyone recommend a company in the UK they have dealt with, that brought them up to compliance?

If you aim to do this before May 15th you will find that anybody that is capable is fully booked for the remainder of 2018.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#39

Post by the_mitsuhiko »

pc86 wrote: post #29
samsari wrote: post #15

Earlier quoted context omitted.

My understanding, as someone implementing the GDPR-compliance for my company right now, is that if you could produce the same one-way hash a second time from the same input email address then the hash is still considered PI.

Do you know how you are supposed to handle disputes in the future? If I ask that all my information be deleted and I say n months later I was charged for something I never received, how does the company disprove that?

You are legally required to retain payment history anyways for many years. So that's out of the GDPR scope.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#40

Post by Ezku »

andriesvh wrote: post #28
Ezku wrote: post #24

> it helps for documentation purpose should the dispute arise over some issue in future. If you are required to hold on to the data for legal purposes such as dispute settlement, there is no issue. The customer can request you delete such data but you have no obligation to do so. Issues arise when holding on to the data is no longer "necessary". At that point soft deletion is not enough and you must be able to remove…

Are you sure about throwing away encryption keys is sufficient to be GDPR complient? Does this comes from IP lawyer as well?

That's a good thing to point out, thanks. No, I'm afraid that bit is my own speculation.
Post reply on HN