Hacker News Reader

Comment by auggierose | Hacker News Reader

How do things like cloud databases work with respect to the GDPR?

Looks like that's addressed:

> "The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU."

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

(However, this is off-topic for this submission specifically.)

> (However, this is off-topic for this submission specifically.)

I think it's on-topic for a database that (in my barely informed understanding) is famous for never deleting anything!

This is explicitly supported in Datomic via an operation known as "excision":

> "Excision is the complete removal of a set of datoms matching a predicate. Excision should be a very infrequent operation, and is designed to support the following two scenarios:"

> "- removing data for privacy reasons"

> "- removing data older than some domain-defined retention period"

> "Excision should never be used to correct erroneous data, and is unsuitable for that task as it does not restore any previous view of the facts. Consider using ordinary retraction to correct errors without removing history."

https://docs.datomic.com/on-prem/excision.html

I haven't read whether or not there's a difference here with respect to the cloud offering, as I wasn't able to find a corresponding Reference section in the cloud docs. However, given that :db/excise is a transaction operation, it's likely supported.

Edit to add: Looks like it currently isn't, see 'davidrupp below. That's important to keep in mind.

https://docs.datomic.com/on-prem/moving-to-cloud.html -> "Other Differences" -> Cloud: "no excision" (edit: "currently")

Thanks for finding this!

> "Furthermore the regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents."

It's really not clear to me how a company like datomic would cope with that in any practical way. Are they supposed to know what kind of data their clients store??

I attended a GDPR session at Re:Invent this year. Basically, there's two types of organizations: data controllers and processors. Datatomic, AWS, Azure, etc. would all fall into the processors category. Amazon.com, however, would fall into the data controller category.

From a processor perspective, they have their own requirements/regulations: https://aws.amazon.com/blogs/security/aws-and-the-general-da...

AWS/Datomic doesn't need to know what kind of data their customers store - it's up to the customer to be compliant with their part of GDPR.

I agree these are important questions, and they apply equally to various offerings in AWS, Google, Microsoft, and others. It's not something specific to Datomic.

Reply on news.ycombinator.com