Hacker News Reader

You also have the right to demand the deletion of your personal data and to revoke the right of a company to process it, as well as to demand correction of inaccurate data.

This is probably the biggest change. Previously, at least in Europe, the emphasis has typically been on allowing people to know what data was being collected and to require correction of inaccuracies, but much less on whether it was actually allowed to be collected in the first place or allowing data subjects to require deletion of data.

I'm a little worried about whether the practical implications of this have been properly considered, which is something the EU has historically been quite bad at doing when it comes to technology and business laws. For example, under (65) in the regulation[1], which is primarily about rights to have personal data deleted and the "right to be forgotten", I see few provisions for a business keeping personal data that it legitimately collected with the subject's consent even if the cost of deleting it is prohibitive. An obvious example would be data that also exists in backups taken during the period of storing and processing that data, all of which would need to be updated in non-trivial ways to remove the data from them.

[1] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:O...

Yes it surely creates some work for companies, but on the other hand what good would it be if you could just keep personal data around just because it happens to be on a backup tape? Companies simply have to implement suitable backup schedules, which will ensure that the data gets deleted within an acceptable time period (e.g. two weeks), which is doable without actively erasing any specific data (instead of simply erasing a whole backup version).

You and I have very different definitions of the word "simply".

Arranging proper backups at all is not something to take for granted when you're dealing with small businesses that have many other things to do, but obviously they're important for safeguarding the provision of products and services to all customers and it's important that any backups that are made are handled with proper regard to both security and integrity.

Requiring businesses to separate every tiny item of data that might ever be legally required from every tiny item of data that is collected and used with consent for reasonable purposes, just in case some customer one day decides to retrospectively withdraw their consent for some or all of that data, could easily become absurdly disproportionate. I hope it would go without saying that incentivizing businesses not to keep backups of all important data because of the compliance overheads is insane.

However, without such fine-grained separation, two weeks might be far too short a period to keep backups. To use my own businesses as an example here, we have accounting and reporting obligations that potentially require several years of data. The reporting information is typically derived once a year during reporting season, from straightforward records kept in the main databases and/or spreadsheets. However, we would probably have to completely restructure those records and denormalize all kinds of things in order to delete everything we don't strictly need for some legal purpose, which would be a huge amount of work.

That's just the structure of the original data. Then you have to consider things like deduplication in online backup services, where it's practically impossible to guarantee the complete destruction of all instances of certain data without destroying all backups that ever involved that data and starting over.

If this is the situation for small businesses that typically only collect a small amount of personal data in the first place and for obvious and necessary purposes, I shudder to think of the implications for organisations that actually process personal data as part of their main purpose rather than incidentally. I'm not sure it's reasonable to assume, in general, that it would even be possible to totally separate legally required data from everything else in such organisations, and there would surely be a lot of grey areas.

Now, please don't misunderstand me. I'm all for reasonable regulation to protect individuals from exploitation. I'm a privacy and civil liberties advocate, and I run my own businesses the way I hope others would run theirs, even if sometimes that means not doing things that would probably make us more money because they also make us feel uncomfortable. But there has to be a sensible balance, and the EU does not have a good track record of balancing its business regulations sensibly. (See also: EU VAT, cookie law, various provisions in the last round of consumer protection rules, etc.)

Companies need to separate personal data from other data as early as possible. Yes, this requires some work and rethinking of data structures, it is doable though. Why would it be impossible to do this in your opinion? Do you have a more concrete example that we can discuss?

In General, I think requiring that companies do not hold on to your personal data indefinitely is a pretty reasonable regulation. If there were exceptions e.g. for backup data it would provide a convenient loophole for companies to keep the data.

Also, if companies keep copies of their personal data lying around it increases the risk of the data being stolen or leaked into the public. We have seen that even for the largest companies it's impossible to avoid "losing" data once in a while, so making sure that this data contains the least amount of sensitive information possible is very reasonable. The regulation does not even assume that companies are malicious, it just assumes that sh*t happens and tries to mitigate potential damage to individuals.

Companies need to separate personal data from other data as early as possible. Yes, this requires some work and rethinking of data structures, it is doable though. Why would it be impossible to do this in your opinion?

I'm very wary of making that assumption, because so much data could potentially be personal data even if it's not obvious. Remember that the real criterion here is data that is or could be linked to an identified individual. With the kind of progress being made with data mining and analysis and the kind of processing power being devoted to those activities today, there are few safe assumptions any more about what becomes impersonal data just because it's been "aggregated" or "pseudonymised".

Let's consider a common example. Suppose a business operates a web site, and like most such businesses it keeps server logs. Those logs are useful for a wide variety of purposes and some of the data may remain useful for long periods, to allow analysis of things like how the site is being used or whether certain patterns are useful for detecting potential threats, or even to provide evidence that a customer did in fact use the services on the site during a certain period in the event of a dispute over charges.

In themselves, those logs probably don't inherently contain personal data. However, each record does have data such as IP addresses within it, which may be quite easy to link to a specific customer in practice and thus make everything in that record into personal data.

Now, suppose a customer who has been using that site for a while stops, and then files a notice to remove all personal data about them that the site operator isn't legally allowed to keep despite that notice. In order to comply with that request, must the site operator therefore delete all records based on the server logs, including any backups or derived data, to which that customer might be connected?

I can't immediately see why the site operator would be allowed to keep those records with a literal reading of the new rules. However, removing them would potentially undermine useful and reasonable business functions such as those mentioned above. Moreover, the cost of doing so might be substantial, and the adjustments required so the infrastructure used to process those logs can support this sort of retrospective editing might also be substantial.

In such a case, I think the balance would usually be too far towards the individual. The imposition on the site operator is great, both in the effort to comply with the request itself and in the damaging effects on reasonable business practices. The risk to the visitor of that potentially identifiable data being used for typical purposes in connection with server logs is low. Unless there are other relevant factors that point the other way (perhaps if the site deals with a particularly sensitive subject) the cost to the site operator is almost certainly disproportionate to the benefit to the individual.

IP addresses are an interesting example, as they're explicitly mentioned as personal data in the directive since in many contexts they're sufficiently unique to associate them with a given user.

Really would like to discuss this further, if you're interested feel free to send me a mail (discoverable via my profile)

1) How does this interact with backups? It would seem impossible to build a safe backup system that can comply with "delete all this user's data" faster than the expiration of the backup retention period. Recovering from backup could potentially reintroduce data about someone who requested deletion.

2) How specific is "for which purposes?" I can't imagine companies would ever go collect explicit opt-ins for every new SELECT statement in their codebases. It seems like the only thing to do is list the broadest possible set of purposes upfront.

3) How do you decide whose data it is? For example, HN comments can't be deleted because they're considered the internet's data, not yours.

What if I sync my contacts containing your phone number, or a photo of us together? If you demand the deletion of "your data" then do my contacts and photos disappear?

What if you make a scene at some establishment, or default on a loan? Can you demand that their record of "let's not do business with this person again" go away?

What if I sync my contacts containing your phone number, or a photo of us together? If you demand the deletion of "your data" then do my contacts and photos disappear?

This is one of the most tricky areas in deciding what is reasonable. Obviously there are advantages to being able to share personal data about other people for your own benefit. On the other hand, every time you do that, you are potentially giving someone personal data without the subject of that data's consent.

I don't think we fully understand the implications of modern technologies in this area yet. However, I suspect we'll be learning some lessons the hard way over the next few years, as the correlation and processing of that data starts to catch up with the volume of data that's been collected.

It's also possible that some of the people giving up that data about other people, or more likely the businesses that encourage individuals to do so, are going to come under a lot of scrutiny even in terms of compliance with existing law and regulations. For example, if you install a social network's app on your phone, and that app uploads your contact list complete with names and phone numbers to their database, then both you and the social network have obviously just compromised the privacy of everyone on your contacts list. That much is black and white, but if the social network concerned then uses that data for any purpose other than providing whatever services you are explicitly requesting in terms of the contact list you already had, then from a data protection point of view it becomes a lot more just black. I'm a little surprised that data protection regulators, particularly in Europe, have taken such a hands-off approach to this issue for as long as they have already.

Woah, didn't know it went this far. If anything, this would be great for facebook (which has been anything but transparent when it comes to what they do with your data when your account is deleted). Google already has some relatively transparent controls on what data they have on you, and allow you to wipe all or parts of it.

But the law only works with companies.

The Internet as whole never forgets

The Internet also has to make money at some point, which means there's usually a corporate entity in the chain, one whose money (for better or worse) eventually touches Western banks.

So yes, the Internet never forgets (things it can make a buck off of).

Actually no. Saying the internet needs to make money is just as wrong as saying the roads need to make money. The net is just an infrastructure that has to be maintained and paiyd for. "Making money" is absolutely not a neccessety.

Ok, we are taxed for the roads and there are some roads that do require you to pay such as toll lanes. Think of Google and facebook as the restaurants and gas stations along the way.

Roads do need to make money. We just happen to have a larger concept of "make money" that encompasses increased commerce.

Mailboxes might be a better example of your point.

I'd argue that the current web looks more like roads than mailboxes though. We would have something more like Minitel if we'd gone the mailboxes route.

Max Schrems, an Austrian lawyer, sued Facebook Ireland over this and got them to release all his data. He also keeps a website where he explains how to get yours: http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...

I tried this back in 2012 after seeing Max profiled on Ars Technica. As someone who never had a FB account I was after my 'shadow profile' data.

Facebook emailed back stating:

"There isn't a Facebook account associated with the email address from which you are writing. This might be because you don't have a Facebook account or because you already deleted your account. In either of these cases, we do not hold any of your personal data."

I didn't ask for data attached to an email address, I asked for any personal data they had collected on _me_ and their answer was evasive and non-responsive. I didn't pursue it any further but I know they are bullshitting me, and I had to move on to other things.

OTOH, it allows public authorities to bypass these regulations for "criminal purposes" and does not define any absolute safe haven rights from that.

Sounds quite similar to Personal Data Protection Act (PDPA) in Singapore:

http://www.pwc.com/sg/en/personal-data-protection.html

> You also have the right to demand the deletion of your personal data

How does it work with data you're legally required to keep? E.g. for tax reasons.

"Dear Mr tax man. I request that you delete me."

Financial institutions and the government are exempt for "necessary information".

Excellent question! Article 17 of the regulation (http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320...) lists some exceptions when the processor (the entity holding your data, e.g. Facebook) is allowed to keep some of your personal data. Most notably, sentence 3b states that data might be kept "for compliance with a legal obligation...", which includes keeping of tax records. Also, as the other poster already said the regulation does not apply in the same way to public institutions like the tax office.

However, the processor would not be able to keep any data beyond what is needed for the purpose for which the exception holds, and the data cannot be used for anything else.

People often joke about the EU being toothless don't they? What penalties exist, as presumably their is a grace period to this that gives companies the time to build the systems in order to respect it? I feel like most small companies will find a way to skirt (or ignore) this as such systems could likely match the complexity of their products themselves..

Small businesses don't need to build complex systems to respect the law. If someone wants their data they can ask for it by email. The business can then manually gather the data from their databases and send it as a ZIP, PDF or whatever.

You can worry about building a system when it makes financial sense compared to the time spent manually dealing with data requests.

ZIP/PDF would not qualify as an exchange format, as the directive clearly states the data must be "in a structured, commonly used and machine-readable format". XML would do, but a PDF definitely not as it's not machine-readable (in the sense that you can easily extract the structure of the raw data from the file).

Fines are only one pillar of the strategy, as the new regulation also makes it significantly easier for individuals to sue companies due to data misuse and loss in a civil court.

But you're right, in the end it will depend on how severely the individual EU countries as well as the commission persecute companies that don't obey the standards. And like in other areas there will be fraud and companies trying to circumvent the regulation. All in all I think the standard for data protection will increase significantly.

This might be naive, but.. Shouldnt the internet be as far removed from regulation as possible? This just opens the doors for more regulation by central authorities.

Why should it be as far removed from regulation as possible? Why not strike a balance where we regulate certain things that are important to us, and leave open the rest?

More regulation is a good thing if things we as a society deem critical can only be accomplished through regulation.

We need to have a balance - definitely a fine line.

The new EU data protection directive is a huge win for users. I think it's going to be amazingly hard (and expensive) for enterprise and SMB to comply. The amount of work and liability to prepare for is massive.

For any smart consultants who are up on PII compliance and associated data security practices, there's an endless amount of work here.

The european data privacy laws have been largely ignored by the big US companies thus far, also because they were supported by the Irish gonvernment which did not really go after the endless number of complaints that were filed. In theory the new regulation should improve things, because it's no longer just a guideline as the previous solution.

If my business runs servers out of Canada that Europeans use, what are the enforcement mechanisms for this law?

European businesses will be punished with the sane terms as well if they use a service which is non eu compliant. So they can only use compliant services.

Ok. That kinda makes sense.

Does it flow through to subsidiaries or EU citizen owned foreign enterprises? Because it seems like this could lead to a regulatory race to the bottom.

It's not important where your servers are or if you are a European company, what matters is that you offer services to people in the EU (market place principle). I am not fully clear on how this will apply to foreign companies that do not advertise/target EU users though.