Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are you implementing GDPR-compliant soft deletes?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#41

Post by jacquesm »

the_mitsuhiko wrote: post #39
pc86 wrote: post #29

Earlier quoted context omitted.

Do you know how you are supposed to handle disputes in the future? If I ask that all my information be deleted and I say n months later I was charged for something I never received, how does the company disprove that?

You are legally required to retain payment history anyways for many years. So that's out of the GDPR scope.

No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#42

Post by kasey_junk »

devdad wrote: post #32
CamperBob2 wrote: post #23

Earlier quoted context omitted.

Government: "You know that data you were required to delete when $(USER) requested to be forgotten? We require you to provide it in connection with our ongoing investigation of $(USER)."

Is this a real issue though? If I comply to regulations to remove data as required by law, I'd be surprised if a government body could require me to provide data I am supposed to have deleted.

This is a very real GDPR fear. Some of its mandates run counter to other local data retention mandates.

It’s not clear yet how that is going to shake out.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#43

Post by no1youknowz »

jacquesm wrote: post #38
no1youknowz wrote: post #36

About the GDPR, can anyone recommend a company in the UK they have dealt with, that brought them up to compliance?

If you aim to do this before May 15th you will find that anybody that is capable is fully booked for the remainder of 2018.

> you will find that anybody that is capable

Define capable. Look at this thread as an example. Many answers contradict each other. There are so many ways to interpret the guidelines, which in many cases have not been thought through.

I have engaged in discussions with 5 companies located in the UK. All gave differing answers on specific questions relating to data for marketing, finance, and fraud.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#44

Post by detaro »

jacquesm wrote: post #41
the_mitsuhiko wrote: post #39

Earlier quoted context omitted.

You are legally required to retain payment history anyways for many years. So that's out of the GDPR scope.

No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.

GDPR explicitly lists processing that is necessarily to fulfill legal obligations by european or local law as permitted without further permission and as a reason to deny a deletion request, that covers at least a lot of it. (although you still have to report your use to the user and follow general guidelines on handling sensitive data of course)

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#46

Post by jacquesm »

no1youknowz wrote: post #43
jacquesm wrote: post #38

Earlier quoted context omitted.

If you aim to do this before May 15th you will find that anybody that is capable is fully booked for the remainder of 2018.

> you will find that anybody that is capable Define capable. Look at this thread as an example. Many answers contradict each other. There are so many ways to interpret the guidelines, which in many cases have not been thought through. I have engaged in discussions with 5 companies located in the UK. All gave differing answers on specific questions relating to data for marketing, finance, and fraud.

That was my point.

You need to know the law inside out to be able to tell someone exactly what to do in their situation. We - our little band of friends - have been reading up on this subject since the previous privacy law was enacted and all I can tell you is that it is much easier to spot things that are in conflict with the law(s) as written than to come up with a single workable solution that does not leave things open to interpretation.

Even so, these laws are good, they will force people to wake up to the underlying issues and to begin to think about their responsibilities when before the mantra seems to have been that any effort spent on privacy and security is better spent on growing the business because otherwise the other guy that doesn't care about those things will eat your lunch.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#47

Post by jacquesm »

detaro wrote: post #44
jacquesm wrote: post #41

Earlier quoted context omitted.

No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.

GDPR explicitly lists processing that is necessarily to fulfill legal obligations by european or local law as permitted without further permission and as a reason to deny a deletion request, that covers at least a lot of it. (although you still have to report your use to the user and follow general guidelines on handling sensitive data of course)

So, it is in scope, since it is covered by the law, and then the law explicitly gives you permission to make an exception. But you'd better do all of the following:

- have a legally trained person review your eventual solution and your reasoning behind it

- document the exceptions, which laws and which datums it covers

- keep track of the law as it changes, especially with new bodies of law such as the GDPR you can expect updates to reflect the situation on the ground and in a way the GDPR itself is such a change.

- be prepared to review the situation/code if the law changes in the future

- be aware that 'data retention' laws are very different from one industry to another (for instance telecommunications is a totally different beast than e-commerce)

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#48

Post by jacquesm »

yread wrote: post #45

What if you outsource the PII? For example use a payment processor and only store their reference. You can always go back to transaction in the payment processor in case of disputes, but you don't store the personal information.

Then you will need a data processing agreement with that IPSP and they will need to prove to you that they are in compliance. The good news is that in that situation there is probably more knowledge and funding available to get things right (but it is obviously not a guarantee).

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#49

Post by ust »

jacquesm wrote: post #33
eb0la wrote: post #26

Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…

I'm going to go out on a limb here and guess that 99% of the companies out there affected by the GDPR and the OP in particular do not have a DPO (yet), and may not realize they need one, and even if they do know that then they likely won't be able to fill the seat either in time or with someone competent. Every year we look at quite a few companies, this is the first year that I've spotted a DPO in the wild, and impr…

Not every company needs a DPO though, e.g. check here:

https://www.eugdpr.org/key-changes.html

Maybe his company doesn't need one. Of course, whether he has a DPO or not, still the question remains of how to "properly" delete the personal data.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#50

Post by [deleted] »

snowwolf wrote: post #20
samsari wrote: post #15

Earlier quoted context omitted.

My understanding, as someone implementing the GDPR-compliance for my company right now, is that if you could produce the same one-way hash a second time from the same input email address then the hash is still considered PI.

Fair point. I can see the purpose of "right to be forgotten", but I think in some circumstances it is going to be abused. Any service that "bans" users for fraudulent/abusive activity and stores data about the banned user to prevent them from creating new accounts is going to have a problem. Banned user can just request to be forgotten and then create a new account. Unless there is some exception within GDPR that wil…

[deleted]
Post reply on HN