Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are you implementing GDPR-compliant soft deletes?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#71

Post by outsideoflife »

no1youknowz wrote: post #43
jacquesm wrote: post #38

Earlier quoted context omitted.

If you aim to do this before May 15th you will find that anybody that is capable is fully booked for the remainder of 2018.

> you will find that anybody that is capable Define capable. Look at this thread as an example. Many answers contradict each other. There are so many ways to interpret the guidelines, which in many cases have not been thought through. I have engaged in discussions with 5 companies located in the UK. All gave differing answers on specific questions relating to data for marketing, finance, and fraud.

General compliance advice

1) Act in good faith. DPA fines seem to have been to people who had a blatant disregard for data protection and their customers, not those who tried hard but committed some technical breach.

2) Whenever new rules come out there is a long period of interpretation. Unless you are in a very high risk category I wouldn't 'throw the baby out with the bath-water' in the interim.

3) Documentation wins court cases.

4) Personally I was already trying not to have my data stolen, so I am not overly concerned by GDPR. I am updating some policies, employee handbooks and terms. I will watch how other companies deal with it before I act too rashly.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#72

Post by jacquesm »

outsideoflife wrote: post #71
no1youknowz wrote: post #43

Earlier quoted context omitted.

> you will find that anybody that is capable Define capable. Look at this thread as an example. Many answers contradict each other. There are so many ways to interpret the guidelines, which in many cases have not been thought through. I have engaged in discussions with 5 companies located in the UK. All gave differing answers on specific questions relating to data for marketing, finance, and fraud.

General compliance advice 1) Act in good faith. DPA fines seem to have been to people who had a blatant disregard for data protection and their customers, not those who tried hard but committed some technical breach. 2) Whenever new rules come out there is a long period of interpretation. Unless you are in a very high risk category I wouldn't 'throw the baby out with the bath-water' in the interim. 3) Documentation w…

The most important bit that you can do that is actionable and that will not be open to interpretation is to have someone competent write a clause into employment contracts regarding data confidentiality, to put in place a protocol on how to deal with various levels of breaches and to review your sites privacy policy to ensure that it is still applicable (this is something you should be doing regularly anyway).

On the whole I think your approach is a very balanced and reasonable one, especially the 'act in good faith' bit. What surprises me is that plenty of companies explicitly do not act in good faith and try to interpret the directive creatively so that they can continue to do what they were already doing without modification. That's asking for trouble in my opinion, some companies in that bracket will find themselves in the un-enviable position of being used to educate the rest.

Especially in adtech and marketing there will be a lot of tension between business goals and the law as written and the finer you want to ride that line the more important it becomes to have competent guidance.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#73

Post by raptorcomp »

Some comments on the legal aspect to deletion under the GDPR: 1. deletion can generally only be requested if the personal data is being processed under the individual´s consent. Thus, other personal data such as under legitimate interest or execution of a contract does not fall under it. 2. The rule on deleting the data is not absolute as data retention laws prevail over this rule. Thus, only if no data rentention law mandates the storing of the data (which is often the case for business communication) then you are obliged to delete the data or anonymize it. Hope this clarifies the non-technical aspect. Dominic Staiger https://www.raptorcompliance.com/en

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#74

Post by raptorcomp »

roel_v wrote: post #56
eb0la wrote: post #26

Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…

Is there anyone reading this whose company has a DPO already? Is it an internal or external person? How technical are they? I'm a developer and I have a law degree; would that put me in an advantageous position to become one? Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed? Or do the big consultancy firms have the GDPR market cornered already? I wouldn't want to go in a di…

THe answer varies depending on the size of the company. However, I have seen many IT related professionals taking over the GDPR issues. In larger companies it is a more legal role. As to your career question: We are currently involved in many different and exciting project that push the boundaries of law and technology with respect to data protection. Currently, everyone is a GDPR consultant but quality and nature of the work differ substantially. For most part it is an exercise in producing documents and procedures to prove compliance. However, when it comes to implementing technical solutions you can really stand out. So if this is an area that you are interested in you should move fast. There is also a growing number of international opportunities as even non-EU companies require GDPR experts.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#75

Post by raptorcomp »

jakozaur wrote: post #13
jjoergensen wrote: post #5

Deletion of backup-data is also an interesting topic

The law itself was written by someone unaware of that. A lot of interpretations: 1. The most extreme, go back to all of your backups and delete them too. 2. You don't need to do anything, if you do not touch the backups and truly treat them for disaster recovery. 3. Your backups need to have reasonable retention (e.g. two year) and way to apply post requests after recovery. 4. A lot of in between. 5. My personal inte…

Answer to point 5: On first glance I would agree with this view, however, there is the factor of market competition you must take into account. If a company only receives a small fine for non-compliance (or is not prosecuted) then its competitor can make the argument that this is anti-competitive conduct as the non-compliant company has saved money through its non-compliance and the fine does not stand in relation to the money saved. Through this argument the fines could increase significantly over a very short timeframe placing great pressure on companies to observe the GDPR. As the money goes to the data protection authorities their ability to prosecute will grow steadily.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#76

Post by yread »

roel_v wrote: post #56
eb0la wrote: post #26

Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…

Is there anyone reading this whose company has a DPO already? Is it an internal or external person? How technical are they? I'm a developer and I have a law degree; would that put me in an advantageous position to become one? Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed? Or do the big consultancy firms have the GDPR market cornered already? I wouldn't want to go in a di…

My employer (3000 employees, medical research) has an internal DPO. I only dealt with him once but was impressed with his technical as well as legal knowledge.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#77

Post by kyriakos »

eb0la wrote: post #26

Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…

As far as I know the data must be properly deleted not just marked as deleted. Essentially you can zero out all fields which include personal information. Keeping the data as soft deleted you still risk it in case of a leak due to a hack.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#78

Post by unkoman »

We're building a consent framework API so our customers can consent for personal data use. Data is then cleaned and transformed (ETL) from personally identifiable to pseudo-anonymised. The data is also separated into two separate encrypted storages for anonymous and pseudo-anonymised data for generalisation and separation. Random (important) hashed identifiers are created and put into a metadata service which is used as a lookup-table. If right to be forgotten is invoked, the data is disassociated from the pseudo-anonymised and personally identifiable data thus making it anonymous.

Important is also how you handle data analytics and this is why we're deploying high restrictions on raw data. Analytics will only be able to be done through an analytics service which can give the employees access to only certain parts of the data which is approved for the use-case. We're using Apache Sentry for fine grained role based authorisation to data and metadata and a directory services for user auth.

Things we've learned:

* Minimise data usage

* Don't use personally identifiable data

* You will need to be able to prove consent when it comes to data usage and it cannot be consent by default, it has to be opt-in

* Log all data access so that use cases can be proved. This needs to be evaluated and audited

* Encrypt in transit and at rest

* Centralise mapping for all data

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#79

Post by kasey_junk »

jacquesm wrote: post #52
kasey_junk wrote: post #42

Earlier quoted context omitted.

This is a very real GDPR fear. Some of its mandates run counter to other local data retention mandates. It’s not clear yet how that is going to shake out.

As HN'er detaro notes in this comment: https://news.ycombinator.com/item?id=16366864 There are some provisions for those situations. And on the subject of backups, those are typically exempt but there are some obvious problems there when you restore a backup at a later time. To me the big ticket items in the GDPR are the notification duty and the data processing agreement 'chain' that gives some level of certainty th…

I agree with your assessment but the penalty part of GDPR is making lawyers more jumpy than any regulation I’ve seen.

I’m putting essentially everything in the we’ll see category.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#80

Post by jacquesm »

kasey_junk wrote: post #79
jacquesm wrote: post #52

Earlier quoted context omitted.

As HN'er detaro notes in this comment: https://news.ycombinator.com/item?id=16366864 There are some provisions for those situations. And on the subject of backups, those are typically exempt but there are some obvious problems there when you restore a backup at a later time. To me the big ticket items in the GDPR are the notification duty and the data processing agreement 'chain' that gives some level of certainty th…

I agree with your assessment but the penalty part of GDPR is making lawyers more jumpy than any regulation I’ve seen. I’m putting essentially everything in the we’ll see category.

I see that as good news :)

It looks like the GDPR at least gets people's attention.

Post reply on HN