Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram kept deleted photos and messages on its servers for more than a year

theverge.com

Post reply on HN
Print view View original

91–100 of 205 posts

Re: Instagram kept deleted photos and messages on its servers for more than a year

#91

Post by londons_explore »

rco8786 wrote: post #79
londons_explore wrote: post #68

Earlier quoted context omitted.

Google takes deletes seriously. Extreme efforts go into deleting stuff within 30 days of the user requesting deletion. Imagine how hard that is when a datacenter is switched off for 14 days for maintenance, and then a fire breaks out and takes it offline for a further 20 days... When something is powered off, it's very hard to do those deletions... Yet misses of the deadline are exceedingly rare, even in cases like t…

.

> But clicking delete or unsend on a photo is not that.

In Google, a user clicking delete is treated exactly the same as a written deletion request.

In fact, the law requires that they be the same - "Therefore, an individual can make a request for erasure verbally or in writing. It can also be made to any part of your organisation and does not have to be to a specific person or contact point.". (https://ico.org.uk/)

Re: Instagram kept deleted photos and messages on its servers for more than a year

#92

Post by jacquesm »

rco8786 wrote: post #89
jacquesm wrote: post #84

Earlier quoted context omitted.

You must be aware that Square is operating a service in a regulated field (fintech) and that openly advertising their possibly illegal business practices is not to their advantage. Let's assume that everything you've said is true that could come in handy one day when a regulator is looking to determine the difference between whether this is an oversight or willful. You are making their job a lot easier and Square's s…

I assure you nothing Square is doing is illegal or even "possibly illegal". Square takes GDPR deletion and right to be forgotten incredibly seriously. But you must understand that soft-deleting an image that the user uploaded is not in violation of any regulation in place in the USA.

"I'm trying to inform folks about data deletion works."

Is hard to reconcile with this comment.

Whether data is an image or some other record is immaterial. If the user (or the controller, for that matter) tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't. Whether your company is based in the USA or not is immaterial.

You also responded to an inquiry of Facebook employees as though you were one, when in fact you work somewhere else entirely. I think you mean well but possibly do not understand the implications of your statements here.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#93

Post by rco8786 »

hawkoy wrote: post #30
rco8786 wrote: post #17

Earlier quoted context omitted.

A fine for what? Not fixing a minor bug in a timely fashion? That’s not a road we want to travel down.

As per my layman understanding, the organization need to comply with the data erasure request within 30-60 days. You cannot retain data for longer without consent or purpose (GDPR).

.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#94

Post by jacquesm »

smcameron wrote: post #39
jermier wrote: post #8

I want to know if the photos are securely deleted. It's not enough that the mere reference to a file is gone. I want everything overwritten with zeroes, and the photo made properly irrecoverable.

Always encrypt the data at rest, and delete by deleting the key is likely how this would be done. This way you can also delete e.g. tape backups without actually loading the tape and re-writing the whole thing with certain portions deleted, which is not really practical.

Yes, this is the best way to do it.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#95

Post by jacquesm »

rco8786 wrote: post #79
londons_explore wrote: post #68

Earlier quoted context omitted.

Google takes deletes seriously. Extreme efforts go into deleting stuff within 30 days of the user requesting deletion. Imagine how hard that is when a datacenter is switched off for 14 days for maintenance, and then a fire breaks out and takes it offline for a further 20 days... When something is powered off, it's very hard to do those deletions... Yet misses of the deadline are exceedingly rare, even in cases like t…

.

Sorry, but no. That is a deletion request. The GDPR tells you exactly what to do once such a request is made. There is no such thing as a 'specific GDPR deletion request'.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#96

Post by jacquesm »

rco8786 wrote: post #93
hawkoy wrote: post #30

Earlier quoted context omitted.

As per my layman understanding, the organization need to comply with the data erasure request within 30-60 days. You cannot retain data for longer without consent or purpose (GDPR).

.

This is not how it works. A deletion request is all that it takes. The difference here is between what you think the requirements are and what they really are. As an engineering manager for a major payment service provider you should know better and it is disturbing that you do not.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#97

Post by rco8786 »

jacquesm wrote: post #31
rco8786 wrote: post #18

Earlier quoted context omitted.

They are definitely not. I’m honestly surprised at how many folks here on HN (a presumably tech savvy crowd) think that Instagram (or any tech co) is “writing zeros” when a user hits a delete button.

Because they should. Incidentally, you are not doing Square any favors with these comments.

I'm responding here because we've hit the limit on the other comment stream, but I truly want you to better informed on this subject so here goes:

> Whether data is an image or some other record is immaterial.

This is wildly inaccurate. The content of the data is extremely important in determining how to properly store and (potentially) dispose of it. If the data contains PII, or is covered under PCI or HIPAA the processes are entirely different. Even under GDPR erasure requests there is specific guidelines for determining what types data should be deleted and for what data should be "vaulted" (aka soft-delete) rather than hard-deleted. Yes, even under GDPR the regulations say to soft-delete.

> If the user tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't.

This is, maybe, a good goal for us to set as an industry but let's be perfectly clear - this is not a reflection of reality today and at it's core, this is my only point. I'm not aware of any fines for not hard-deleting a single piece of data but always ready to be more informed here, please shoot me that source.

That said, besides the technical challenges of actually deleting the data (which I agree are not a reason or an excuse to not delete it, and the GDPR does a great job of outlining this) there are myriad reasons to keep it around. There's a reason MacOS has Trash and Windows has a Recycle Bin, and a few dozen tools in existence for recovering data even once they've been deleted from those places. Many of these use cases are actually beneficial to the user. "Undelete" is a real thing that users expect to be available (often for good reason)...and this is impossible after writing zeros.

Data deletion is a very nuanced subject and treating it as black and white does no one any good.

> Whether your company is based in the USA or not is immaterial.

Again, incorrect. The regulatory body in effect is extremely material. I mentioned USA because those are the rules I am most familiar with.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#98

Post by luckylion »

jacquesm wrote: post #58
davidhyde wrote: post #32

Earlier quoted context omitted.

Why small fines initially? I’d like to see privacy fines being used to make lots of money like traffic fines are used today. It’s a way to tax tech companies in your jurisdiction with the added benefit of improving privacy.

Because the goal is compliance, not to put companies out of business. When the laws were first enacted everybody was screaming that it was just to put companies out of business. Now they are wondering why the small initial fines. It's simple: change your ways and use the initial fines as a wake up call. If you then do not wake up and persist the fines will get heavier and heavier until you will pay attention. A Dutch…

> Because the goal is compliance, not to put companies out of business.

There's middle ground between "we take 100% of your revenue" and "we take 0.001% of your revenue". Given that we're not this lenient with private citizens and small companies, why should we be with international corporations?

Re: Instagram kept deleted photos and messages on its servers for more than a year

#99

Post by frosted-flakes »

rco8786 wrote: post #93
hawkoy wrote: post #30

Earlier quoted context omitted.

As per my layman understanding, the organization need to comply with the data erasure request within 30-60 days. You cannot retain data for longer without consent or purpose (GDPR).

.

Is there? I don't know what's true, but I'll just quote this comment by londons_explore from another subthread:

> > But clicking delete or unsend on a photo is not that.

> In Google, a user clicking delete is treated exactly the same as a written deletion request.

> In fact, the law requires that they be the same - "Therefore, an individual can make a request for erasure verbally or in writing. It can also be made to any part of your organisation and does not have to be to a specific person or contact point.". (https://ico.org.uk/)

https://news.ycombinator.com/item?id=24157667

Re: Instagram kept deleted photos and messages on its servers for more than a year

#100

Post by davidhyde »

jacquesm wrote: post #58
davidhyde wrote: post #32

Earlier quoted context omitted.

Why small fines initially? I’d like to see privacy fines being used to make lots of money like traffic fines are used today. It’s a way to tax tech companies in your jurisdiction with the added benefit of improving privacy.

Because the goal is compliance, not to put companies out of business. When the laws were first enacted everybody was screaming that it was just to put companies out of business. Now they are wondering why the small initial fines. It's simple: change your ways and use the initial fines as a wake up call. If you then do not wake up and persist the fines will get heavier and heavier until you will pay attention. A Dutch…

Imagine if we lived in a society where you were given a small fine for the first time you commit murder and then life imprisonment for the second offence. This may lead people to believe that murder is a serious but forgivable offence when it is not. That’s my first argument: small fines play down the seriousness of the “crime”.

My second argument is the efficiency of using capitalism to fight capitalism. Take money from companies who make mistakes with personal information. Be that out of ignorance, malice or bad luck. Why does it need to be fair and just - make money from it. Make it a risk to capture personal information in the first place. If those companies go out of business then so be it. Others will take their place. It’s not impossible to do business without storing personal information, there is just not enough incentive to bother.

Post reply on HN