Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram kept deleted photos and messages on its servers for more than a year

theverge.com

Post reply on HN
Print view View original

101–110 of 205 posts

Re: Instagram kept deleted photos and messages on its servers for more than a year

#101

Post by jacquesm »

davidhyde wrote: post #100
jacquesm wrote: post #58

Earlier quoted context omitted.

Because the goal is compliance, not to put companies out of business. When the laws were first enacted everybody was screaming that it was just to put companies out of business. Now they are wondering why the small initial fines. It's simple: change your ways and use the initial fines as a wake up call. If you then do not wake up and persist the fines will get heavier and heavier until you will pay attention. A Dutch…

Imagine if we lived in a society where you were given a small fine for the first time you commit murder and then life imprisonment for the second offence. This may lead people to believe that murder is a serious but forgivable offence when it is not. That’s my first argument: small fines play down the seriousness of the “crime”. My second argument is the efficiency of using capitalism to fight capitalism. Take money…

(1) this isn't murder, so that's a false equivalent. Murder is in a different book of law than privacy laws.

(2) small fines do not play down the seriousness of the transgression (which is the word I think you should be using for instances like this). They merely indicate that you should clean up your act assuming no real harm has been done. In some cases the regulators have immediately resorted to fines, and quite large ones as well if they felt that the case warranted it. They do have that option.

But putting companies out of business was never the goal, contrary to what a lot of alarmist people were screaming when the law went into force. Also, over time as more and more companies have been fined I would expect that the initial fines will go up because claiming ignorance really isn't an option any more. Some comments in this thread are particularly worrisome in that light, it appears that some people still don't get it and they are in positions where they really should know better.

Turning data into a liability rather than an asset is the long term outcome. This will take time, and when it happens I'll be that much happier. Every company will have to seriously weigh the price of holding on to some datum vs the price of losing it.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#102

Post by j45 »

I'm surprised Social Media networks don't convey when your data is actually 'deleted'. This approach seems a little more evident in the "archive" status on Instagram.

A flag to mark data for deletion makes sense at scale.. given the number of other automated processes that run more often than a few times a year.. the user should be in control of their information and intent.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#103

Post by j45 »

tgsovlerkhgsel wrote: post #4

> "The researcher reported an issue where someone’s deleted Instagram images and messages would be included in a copy of their information (...) We’ve fixed the issue" This makes it sound like they consider "you could see it" the issue, not "we were still keeping it". In other words, the fix was to hide it, not to delete it. If I were the Irish DPA (and actually wanted to do my job and had the resources to, instead o…

If it takes deleting one's account to truly wipe your data, it should be made clear.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#104

Post by hansvm »

rco8786 wrote: post #17
searchableguy wrote: post #6

> Pokharel discovered the bug in October last year and says it was fixed earlier this month (2020, august) Shouldn't there be fines for this? Took almost an year after being reported.

A fine for what? Not fixing a minor bug in a timely fashion? That’s not a road we want to travel down.

I still don't get why we're all writing bugs in production software in the first place. I know it's a time-honored tradition in this field, but I'm starting to think the practice is a net negative -- at least we should cut back a bit to be able to respond to requests like this in a timely fashion.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#105

Post by jacquesm »

rco8786 wrote: post #97
jacquesm wrote: post #31

Earlier quoted context omitted.

Because they should. Incidentally, you are not doing Square any favors with these comments.

I'm responding here because we've hit the limit on the other comment stream, but I truly want you to better informed on this subject so here goes: > Whether data is an image or some other record is immaterial. This is wildly inaccurate. The content of the data is extremely important in determining how to properly store and (potentially) dispose of it. If the data contains PII, or is covered under PCI or HIPAA the pro…

As engineering manager of a large household name company you really should know better. PII isn't even a term under the GDPR.

But feel free to play fast and loose with this and see where it ends up, as far as I'm concerned it can't happen fast enough that regulators crack down on companies that wilfully ignore the law.

The GDPR does not say to 'soft delete', it says to delete, and that you should make every reasonable effort to do so.

The term 'soft delete' does not occur even once in the reference text for the GDPR. That there are valid cases for soft delete may be true but these are not the norm, they are the exceptions. The owner of the data (end user) has agency. If you wilfully ignore their instructions then you are prime game for the regulators. Whether this data is privacy sensitive or not doesn't matter, the only reason you might be allowed to hold on to it is if there is a legal requirement to do so.

Whether the industry as a whole has not caught up with the law - and Square apparently in particular - is a red herring, it should have caught up by now. That companies chose to spend their resources on other things than compliance isn't my problem, but it will be their problem.

If you are familiar with the rules in the United States but not the ones in Europe then why do you tell me how the GDPR works when clearly you have no clue.

Our compliance officer would have a field day auditing you and you are dangerously incompetent to make all these claims in public representing a company that has a lot of business in Europe and plans to do a whole lot more.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#107

Post by treeman79 »

jacquesm wrote: post #21

This sort of practice is not limited to just Instagram. Plenty of places that do soft deletes when they should be doing hard deletes. Data life-cycles are about the poorest understood subject in startup land. Ingestion is usually top notch, friction free and heavily automated. Deletion - assuming it even exists - is semi automatic or even manual, full of friction and usually incomplete or broken. You see a similar pa…

I implemented a new feature at a big well established company.

Feature broke then companies replication.

After an extremely confusing conversation with the database team, i realized that they only replicated writes and updates.

I was the first in the history of the company to delete records.

They couldn’t imagine deleting anything. I couldn’t imagine keeping stale user data.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#108

Post by jacquesm »

luckylion wrote: post #98
jacquesm wrote: post #58

Earlier quoted context omitted.

Because the goal is compliance, not to put companies out of business. When the laws were first enacted everybody was screaming that it was just to put companies out of business. Now they are wondering why the small initial fines. It's simple: change your ways and use the initial fines as a wake up call. If you then do not wake up and persist the fines will get heavier and heavier until you will pay attention. A Dutch…

> Because the goal is compliance, not to put companies out of business. There's middle ground between "we take 100% of your revenue" and "we take 0.001% of your revenue". Given that we're not this lenient with private citizens and small companies, why should we be with international corporations?

That's why the fines can be ramped up. The largest fines were a substantial fraction of the revenues for the companies they were addressed to and there is no practical limit once you take per violation figures into account. You ignore this at your peril.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#109

Post by jacquesm »

treeman79 wrote: post #107
jacquesm wrote: post #21

This sort of practice is not limited to just Instagram. Plenty of places that do soft deletes when they should be doing hard deletes. Data life-cycles are about the poorest understood subject in startup land. Ingestion is usually top notch, friction free and heavily automated. Deletion - assuming it even exists - is semi automatic or even manual, full of friction and usually incomplete or broken. You see a similar pa…

I implemented a new feature at a big well established company. Feature broke then companies replication. After an extremely confusing conversation with the database team, i realized that they only replicated writes and updates. I was the first in the history of the company to delete records. They couldn’t imagine deleting anything. I couldn’t imagine keeping stale user data.

Unfortunately, still par for the course but changing.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#110

Post by totalZero »

kevincox wrote: post #59
jacquesm wrote: post #21

This sort of practice is not limited to just Instagram. Plenty of places that do soft deletes when they should be doing hard deletes. Data life-cycles are about the poorest understood subject in startup land. Ingestion is usually top notch, friction free and heavily automated. Deletion - assuming it even exists - is semi automatic or even manual, full of friction and usually incomplete or broken. You see a similar pa…

I think just about everything should be a soft delete, however you need a time limit where you sweep those. Ideally you would even give the user an option to accelerate that (as much as technically possible) if they really want something gone.

"If we tell people that we're going to delete their data then we need to do that." -- Chairman Zuckerberg

I understand the user utility of a brief soft-delete period, but that hard-delete sweep should be performed on a fairly tight delay.

Post reply on HN