Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram kept deleted photos and messages on its servers for more than a year

theverge.com

Post reply on HN
Print view View original

21–30 of 205 posts

Re: Instagram kept deleted photos and messages on its servers for more than a year

#21

Post by jacquesm »

This sort of practice is not limited to just Instagram. Plenty of places that do soft deletes when they should be doing hard deletes. Data life-cycles are about the poorest understood subject in startup land. Ingestion is usually top notch, friction free and heavily automated. Deletion - assuming it even exists - is semi automatic or even manual, full of friction and usually incomplete or broken.

You see a similar pattern with respect to signups vs account cancellation.

The weird thing to me is that it is usually the marketing department and not the legal or the compliance department that has the upper hand in these data retention discussions. Fortunately thanks to the GDPR this is now changing and slowly companies are coming around on this.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#22

Post by llarsson »

victords wrote: post #20
rco8786 wrote: post #14

Some real (understandable) ignorance about how the tech industry works in this article. There should be no expectation that Instagram ever deletes anything permanently from their servers. The bug was showing users photos that were internally marked as deleted. Not that the photos were not in fact removed from Instagrams servers.

> There should be no expectation that Instagram ever deletes anything permanently from their servers. No, there should be this expectation. If I have a photo of myself that I'm not comfortable being saved somewhere, there should be an expectation that when I delete this from a service, that service will actually delete it. The expectation should be that the service will do what it said, not that it hid everything ver…

The GDPR and its right to be forgotten agrees with you.

This is grounds for sending a strong message to Instagram for not doing what they are legally bound to doing.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#23

Post by dboreham »

victords wrote: post #20
rco8786 wrote: post #14

Some real (understandable) ignorance about how the tech industry works in this article. There should be no expectation that Instagram ever deletes anything permanently from their servers. The bug was showing users photos that were internally marked as deleted. Not that the photos were not in fact removed from Instagrams servers.

> There should be no expectation that Instagram ever deletes anything permanently from their servers. No, there should be this expectation. If I have a photo of myself that I'm not comfortable being saved somewhere, there should be an expectation that when I delete this from a service, that service will actually delete it. The expectation should be that the service will do what it said, not that it hid everything ver…

Unfortunately this isn't how computer storahe works. This is why the military have acid baths for their disk drives.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#25

Post by jacquesm »

robjan wrote: post #11
lend000 wrote: post #10

Earlier quoted context omitted.

DELETED=TRUE

This is how most services work at scale. It's much cheaper to set a flag than actually delete an entry in a database. The data can then be scrubbed by some periodic maintenance process.

Only that doesn't typically happen. It just sits there, for years or until the company goes bust.

The typical reasoning is that marketing wants to hold on to the data, they will never ever say 'ok, enough, you may delete it' because there is this infinitely small chance that they can re-activate an account, market to it for some other product (no matter that that is against the GDPR) or to sell the data to some third party if there ever is a cash crunch or panic. They see data as having positive value no matter what, whereas data that you shouldn't be holding on to is actually a liability.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#26

Post by jacquesm »

rco8786 wrote: post #17
searchableguy wrote: post #6

> Pokharel discovered the bug in October last year and says it was fixed earlier this month (2020, august) Shouldn't there be fines for this? Took almost an year after being reported.

A fine for what? Not fixing a minor bug in a timely fashion? That’s not a road we want to travel down.

This is not a 'minor bug'. This is a major oversight and possibly a regulatory issue. The user owns the data. The user has rights.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#27

Post by have_faith »

dboreham wrote: post #23
victords wrote: post #20

Earlier quoted context omitted.

> There should be no expectation that Instagram ever deletes anything permanently from their servers. No, there should be this expectation. If I have a photo of myself that I'm not comfortable being saved somewhere, there should be an expectation that when I delete this from a service, that service will actually delete it. The expectation should be that the service will do what it said, not that it hid everything ver…

Unfortunately this isn't how computer storahe works. This is why the military have acid baths for their disk drives.

In this particular case they are actively not attempting to delete the image at all, a big difference.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#28

Post by jacquesm »

rco8786 wrote: post #14

Some real (understandable) ignorance about how the tech industry works in this article. There should be no expectation that Instagram ever deletes anything permanently from their servers. The bug was showing users photos that were internally marked as deleted. Not that the photos were not in fact removed from Instagrams servers.

You are several years out of touch with the regulatory environment. The GDPR is pretty clear about this sort of thing and if you do not actually delete data upon request but pretend you do that might not be construed to be an accident but willful. Your comments in this thread provide further evidence that this is in fact the case.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#29

Post by eckza »

rco8786 wrote: post #17
searchableguy wrote: post #6

> Pokharel discovered the bug in October last year and says it was fixed earlier this month (2020, august) Shouldn't there be fines for this? Took almost an year after being reported.

A fine for what? Not fixing a minor bug in a timely fashion? That’s not a road we want to travel down.

God forbid that software developers be held accountable for their actions, right?

Re: Instagram kept deleted photos and messages on its servers for more than a year

#30

Post by hawkoy »

rco8786 wrote: post #17
searchableguy wrote: post #6

> Pokharel discovered the bug in October last year and says it was fixed earlier this month (2020, august) Shouldn't there be fines for this? Took almost an year after being reported.

A fine for what? Not fixing a minor bug in a timely fashion? That’s not a road we want to travel down.

As per my layman understanding, the organization need to comply with the data erasure request within 30-60 days. You cannot retain data for longer without consent or purpose (GDPR).
Post reply on HN