Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apache Kafka and GDPR compliance

landoop.com

Post reply on HN
Print view View original

41–47 of 47 posts

Re: Apache Kafka and GDPR compliance

#41

Post by jgeraert »

tscs37 wrote: post #36
sulam wrote: post #27

Earlier quoted context omitted.

I believe your understanding is incorrect. GDPR certainly includes storage and processing, both of which backups probably trigger. Anyway, think about the spirit of the law, and then think about how that interacts with backups. If someone asks to be deleted from your system, you do so, and then you restore a backup with their data, you have clearly violated the intent.

Keep a log of deleted users and re-delete upon restore. The GDPR contains exceptions for data storage for which it is infeasible or outside reasonable effort to delete individual records or you have legal compliances to uphold.

Isn't the log of deleted users subject to the GDPR then?

Re: Apache Kafka and GDPR compliance

#42

Post by zaarn »

jgeraert wrote: post #41
tscs37 wrote: post #36

Earlier quoted context omitted.

Keep a log of deleted users and re-delete upon restore. The GDPR contains exceptions for data storage for which it is infeasible or outside reasonable effort to delete individual records or you have legal compliances to uphold.

Isn't the log of deleted users subject to the GDPR then?

No since the GDPR exempts things you need for legal compliance, thus a list of users who have asked to be deleted is fine if it's being used to ensure compliance.

Re: Apache Kafka and GDPR compliance

#43

Post by hobofan »

jgeraert wrote: post #41
tscs37 wrote: post #36

Earlier quoted context omitted.

Keep a log of deleted users and re-delete upon restore. The GDPR contains exceptions for data storage for which it is infeasible or outside reasonable effort to delete individual records or you have legal compliances to uphold.

Isn't the log of deleted users subject to the GDPR then?

You can make a log of deleted users without it containing personally identifiable information, by just storing the IDs.

Re: Apache Kafka and GDPR compliance

#44

Post by hobofan »

polskibus wrote: post #21

I'm wondering if anyone thought about a GDPR extension that would include machine learning extension, ie. being forgotten meant "unlearning" to the model from my data (or relearning it on dataset from which my data was removed).

I would consider that already covered under the GDPR. Most machine learning approaches today make little to no guarantees about differential privacy and allow for (partial) extraction of the training dataset, which would mean that the request for deletion was never fully fulfilled.

Re: Apache Kafka and GDPR compliance

#45

Post by polskibus »

hobofan wrote: post #44
polskibus wrote: post #21

I'm wondering if anyone thought about a GDPR extension that would include machine learning extension, ie. being forgotten meant "unlearning" to the model from my data (or relearning it on dataset from which my data was removed).

I would consider that already covered under the GDPR. Most machine learning approaches today make little to no guarantees about differential privacy and allow for (partial) extraction of the training dataset, which would mean that the request for deletion was never fully fulfilled.

So do you mean that GDPR allows for a request for removal from model or of there is an exemption from data mining results?

Re: Apache Kafka and GDPR compliance

#46

Post by hobofan »

polskibus wrote: post #45
hobofan wrote: post #44

Earlier quoted context omitted.

I would consider that already covered under the GDPR. Most machine learning approaches today make little to no guarantees about differential privacy and allow for (partial) extraction of the training dataset, which would mean that the request for deletion was never fully fulfilled.

So do you mean that GDPR allows for a request for removal from model or of there is an exemption from data mining results?

I think that it allows for a request for removal from the model unless it can be proven that the PII cannot be retrieved from the model.

(This should not be considered legal advice by me.)

Re: Apache Kafka and GDPR compliance

#47

Post by wiz21c »

tscs37 wrote: post #5
wiz21c wrote: post #3

Earlier quoted context omitted.

It's not that simple. For example in my business, we may give some money to help someone "once in its life" (the law says so). Therefore, if the persons asks to be deleted, then we might not apply the law anymore because it'll mean we won't remember the decision... I think GDPR is a good thing, but at some point, in my business, those who write the laws will have to be aware of it (and the legal teams is miles away f…

The GDPR offers exceptions to the right to erasure, this mostly includes legal compliance (banks) or in the interest of legal claims or when data cannot be easily deleted as individual record. It also does not affect any non-digital documents which aren't filed. This is all laid out very thoroughly in the legal documents relating to this.

I must recognize I didn't read the section about removal thoroughly. But I did read the articles about the "categories of data" which are the major pain point right now 'cos it forces you to, well, find appropriate categories of data. It's a very interesting thing to do but, in my organization, it leads to many loooong discussions :-)
Post reply on HN