Hacker News Reader

Comment by benevol | Hacker News Reader

> Then I went through my profile and replaced all fields with empty or no fake data.

Facebook/WhatsApp is a gold mine for the NSA and the CIA (as well as others). I would be surprised if they ever deleted any data when you "update" a field. It seems far more likely that they keep 100% of all data ever entered and just display the latest entry of your "update history".

View on HN

I can confirm they keep old data, you can get a sample when you download your data archive in your Facebook settings.

Not deleting data is a crime under EU law, which is interesting.

It is not a crime currently, and even under the GDPR it's not absolute, it also gives most companies an easy way out as they can deny requests based on "for exercising the right of freedom of expression and information;". https://gdpr-info.eu/art-17-gdpr/

Also "deletion" and "processing" are very vaguely defined terms. Data can be made inaccessible while complying with deletion, but more importantly data can be abstracted in a manner that it is accessible but still compliant with the right to be forgotten.

I've worked on a few solutions for deep analytics this past year specifically designed to keep the data while being 100% compliant with the silly GDPR regulations including the right for erasure.

The right to be forgotten is entirely separate.

This is deleting data that you have contributed yourself.

Any data you have submitted, you have to be able to revoke, and get removed.

No, the right to be forgotten is not a separate issue.

The new EU privacy regulation is the GDPR and it has a data deletion clause but it's not absolute.

There is no EU law that mandates hard deletion of data.

Member states can have stricter laws but the two I am familiar with which are the DPA (U.K.) and BDSG (Germany) also do not mandate it.

There is also no definition of data you've submitted or data that has been collected only consent to store and or process data.

The BDSG literally has 3 sections that demand hard deletion of data.

This is not something new and surprising, this has been long discussed.

Again, deletion as in an actual destructive process isn't required by any EU regulation.

That’s an interesting interpretation, because when I asked the ULD, they had quite a different interpretation of that.

The data can be deleted or anonymised, and the deletion can also be soft, as long as no one can query your data specifically no one really cares how it's stored.

https://uk.practicallaw.thomsonreuters.com/3-502-4080?transi...

Reply on news.ycombinator.com