[deleted]
Ask HN: How are you implementing GDPR-compliant soft deletes?
61–70 of 86 posts
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#62Ladies, gents... The kinds of things you are saying/asking about GDPR are the same kinds of things being asked on this side of the pond...
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#63Earlier quoted context omitted.
Not every company needs a DPO though, e.g. check here: https://www.eugdpr.org/key-changes.html Maybe his company doesn't need one. Of course, whether he has a DPO or not, still the question remains of how to "properly" delete the personal data.
It is quite well possible their company does not need a DPO. But given the nature of the question there is some evidence they do, besides that hiring a DPO is not something done in isolation but most likely as as the result of a GDPR impact study done in ... 2017 or so, which I'm going to again guess was not in the cards for many companies. So, in summary: likely the vast majority of the companies affected is only no…
Yeah, I agree with everything you said.
It would be interesting to know whether the big companies have addressed (at least partially) their GDPR compliance. Maybe they do just "play Russian roulette" like you said, and hope for the best.. Of course, implementation guidelines are not yet fully defined (like WP29 opinions, some of them will change, even then, those opinions are not legally binding).
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#64OK. Here goes... Advice...
Firstly, download the regulation itself. At the very least, read article 17. Article 17 concerns something called "The right to be forgotten". It is about 25 lines of legalese. Once you have read it, have a think about it. Then read it again and have a longer thing about its implications. Then, just to be sure you have not gone stark staring bonkers, read the rest. Carefully. Be under no illusion, the GDPR is a game changer in information management terms, let alone anything else.
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#65Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…
Is there anyone reading this whose company has a DPO already? Is it an internal or external person? How technical are they? I'm a developer and I have a law degree; would that put me in an advantageous position to become one? Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed? Or do the big consultancy firms have the GDPR market cornered already? I wouldn't want to go in a di…
Yes, but it was a token gesture to DPA and in reality
1) It was not their main role
2) It was a token gesture, someone to address post too!
Every consulting firm I know is trying to sell GDPR services atm...
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#66But it is only part of a series of new bits of legislation that is being introduced in Europe related to computer security Some other acronyms "PECR" something all marketeers should have a look at as it governs things like email distribution
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#67Earlier quoted context omitted.
Yep, we've been through this discussion where I work just a few days ago and one way hashing even with salt is _not_ compliant as you can search for whatever you hashed and get a hit (SSNs, emails etc).
While GP stated soft-deletes aren't allowed, I figured I'd contribute to this thought exercise. What about symmetric encrypting the field(s) and then giving the customer the key, and tell them to print it or store it safely, or else they won't be able to recover? And then don't store the key or write it to disk (remove it from memory)
Then you might as well scramble the data completely as the customer is not supposed to be able to recover the data after deletion.
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#68because the GDPR is a tad vague, given the interconnected world we live in nowadays (I am a brit living in a small (very) town called Tidworth which is a pin prick o the map) there is something called "Working Party 29" which is providing some fairly detailed and verbose refinements of definition of key phrases and terms. This is an attorneys bean feast as far as I am concerned because of the vagueness, if nothing else..
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#69Earlier quoted context omitted.
It is quite well possible their company does not need a DPO. But given the nature of the question there is some evidence they do, besides that hiring a DPO is not something done in isolation but most likely as as the result of a GDPR impact study done in ... 2017 or so, which I'm going to again guess was not in the cards for many companies. So, in summary: likely the vast majority of the companies affected is only no…
Yeah, I agree with everything you said. It would be interesting to know whether the big companies have addressed (at least partially) their GDPR compliance. Maybe they do just "play Russian roulette" like you said, and hope for the best.. Of course, implementation guidelines are not yet fully defined (like WP29 opinions, some of them will change, even then, those opinions are not legally binding).
From what I've seen it strongly depends on the vertical but there are outliers both ways. With medical and fintech (banks, IPSPs, insurance) you can expect they are on average doing ok though there are some bad counterexamples. E-commerce is only just now starting to wake up and everybody else is going to be playing catch-up for the next couple of years.
Note that my sample is relatively small and mostly western European countries (nl, be, de, uk).
Re: Ask HN: How are you implementing GDPR-compliant soft deletes?
#70because the GDPR is a tad vague, given the interconnected world we live in nowadays (I am a brit living in a small (very) town called Tidworth which is a pin prick o the map) there is something called "Working Party 29" which is providing some fairly detailed and verbose refinements of definition of key phrases and terms. This is an attorneys bean feast as far as I am concerned because of the vagueness, if nothing el…
You can 'edit' your comments until they are one hour old, so you don't have to make many different top level comments.
Also, if you want to make a larger comment it is usually possible to resize the input field.