Comment by fencepost | Hacker News Reader

Comment by fencepost | Hacker News Reader

I haven't really dug into it being in the USA, but from what I've heard the big takeaway for my clients might be: "You can never again accept a European as a patient, and for your own protection you might need to dismiss any European patients you have." I'm not really worried about legitimate cases where someone wants their data removed, as that seems unlikely. I'm less sure about the risks of some enterprising young lawyer over there finding a way (or a possible way that would end up thrown out) to leverage it to extort money.

Read at its bluntest, as I understand it this law seems to basically ban backups, at least those retained for any significant amount of time. Have a customer/patient database on a cycle of daily/weekly/monthly backups that get pruned as they get older? You need to be able to purge any individual who requests it from those backups. Have regulatory or contractual requirements on keeping records? Well, that's what the courts are for, hope you like the attorneys you're going to be paying. Heck, for medical practices I've heard of insurance companies doing clawbacks of payments years after the date of service - what does a practice do if it serves a European with temporary insurance, gets a request to purge that person's data, then gets a request for clarification from an insurance company?

Perhaps this is a complete non-issue for US companies, but I'm not so certain of that that I'd be willing to just dismiss it out of hand and if it's not dismissed then parts of it are pretty scary.

I’m currently doing GDPR consulting for an American company.

The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though. If payment processing stays open for years, then years is fine. I have a customer who keeps data for ten years.

The GDPR doesn’t say that a European can claim “right to be forgotten” and force you to destroy invoices proving you did Work for hire.

If for some reason they want you to stop processing (right to object) then they end up owing the money themselves- since they can’t force you to forget the invoice, having you unable to send their invoice to insurance sounds like a bad move on their part.

Reading the GDPR “at its bluntest” is not the correct way to do things: European courts are not amused by a narrow view of the law when it is used to argue something is technically legal, not do they use their maximum force for minor infraction.

That’s why you don’t need to worry about an “enterprising” European taking you to the cleaners because the courts won’t think it’s funny either.

It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing.

The GDPR doesn’t ban backups. You must inform the subject of how long you keep those backups though.

And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario.

Reading the GDPR “at its bluntest” is not the correct way to do things

And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level.

It also means that if you know what personal data you have, what you do with it, disclose to the subject those things including who specifically you share it with, and protect that personal data like your business depends on it, then you’ll be fine because the point of the GDPR is that this is what you should be doing.

Nope, because the right to erasure is not negated because of those sorts of common sense, only specific criteria listed explicitly in the GDPR. And as things stand right now, that right to erasure immediately runs into all the issues of uncertainty raised by many in this discussion and other forums.

> And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario.

If the blocks are deduplicated because the reference count of the bit map remains greater than one then I don't see the problem: Just because John Smith can ask you to delete him from your database doesn't mean he can ask you to delete all John Smiths.

Also: European courts aren't amused by this kind of nonsense.

> And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level.

Sure you can. You can look to the historical application of various other similar laws and get an idea of what the regulators are likely to do.

For what it's worth: European courts cannot be legally bound to do anything. If they think you're being an asshole but are "technically within the law" they'll still fine you.

That's just how it works here: Hurting people is simply not ok.

> Nope, because the right to erasure is not negated because of those sorts of common sense

It's not "common sense" at all: Being afraid of the government and the police isn't something civilised countries have to deal with.

Why would anyone think that the government is trying to hurt people if everyone agrees hurting people is not okay?

The at least theoretical problem I face is that there are potentially conflicting laws. Sure, that's why courts exist, but courts are expensive. That's why patent trolls try for "settlements" of less than $50k - it's cheaper than defending a case.

Theoretical case: 5-doctor pediatric practice running an on-site EMR. Backups include fairly short-duration full images for ease and speed of disaster recovery, plus longer-term file and database backups such that basically no scanned document or received fax will ever be lost from the backups and end-of-month database backups will be retained indefinitely. Beyond a year or two it will be possible for incremental changes to be lost if multiple changes happen within a single month.

The practice is required by US law to retain some of that data for years (7, 10, until age 18, 7 years after 18, whatever) or indefinitely (e.g. vaccination records) even if/when the patient leaves the practice. With paper charts that meant that inactive charts went into long-term storage, then eventually were shredded after the expiration of that time period. I'm not sure how vaccination records were kept, but I suspect there were either copies both in the chart and in a separate vaccination-only list or that they were pulled from the charts either before storage or before shredding. There were no backups.

With EMRs, there's no good way to pull a single "chart" out of those backups. There are also not separate systems for tracking things depending on how long they have to be retained. In the case of a pediatrician's office then the answer to "how long do you keep the records" is "until the practice closes, and at that point they must be passed along to another practice."

As for the case of destroying invoices, it's not that simple. The "invoice" would be the bill sent to the insurance company or patient including diagnostic and procedure codes, but the insurance companies may come back even years later for "chart review" on charges they've paid and in that case they're not looking for the codes they're looking for the supporting documentation in the patient chart.

Finally, regarding "enterprising" attorneys wasn't there a whole situation some years back where third party attorneys in Germany were going after alleged copyright infringers "on behalf of" companies that had never heard of them? My Google-fu failed me on this, but I didn't spend a huge amount of time looking. Is there a comparable risk here? I'm not worried about someone actually getting hit with a 10 million Euro fine, I'm more worried about that annoyance-factor "Remove my client's data from the data that you are required by law to keep, come to Europe to defend your failure to do so, or pay my client to abandon this action."

> That's why patent trolls try for "settlements" of less than $50k - it's cheaper than defending a case

FYI: In Europe, if someone sues you and loses, you can usually recover your costs.

> Theoretical case: 5-doctor pediatric practice running an on-site EMR. Backups include fairly short-duration full images for ease and speed of disaster recovery, plus longer-term file and database backups such that basically no scanned document or received fax will ever be lost from the backups and end-of-month database backups will be retained indefinitely. Beyond a year or two it will be possible for incremental changes to be lost if multiple changes happen within a single month.

There's no need to worry about this. Simply record a list of who wants to be forgotten and consult it when restoring from backup.

> The practice is required by US law to retain some of that data for years (7, 10, until age 18, 7 years after 18, whatever) or indefinitely (e.g. vaccination records) even if/when the patient leaves the practice.

Explain to the europeans that visit your on-site EMR that you are required by law to keep data in the way you just explained it.

> With EMRs, there's no good way to pull a single "chart" out of those backups. There are also not separate systems for tracking things depending on how long they have to be retained. In the case of a pediatrician's office then the answer to "how long do you keep the records" is "until the practice closes, and at that point they must be passed along to another practice."

That's perfectly fine.

Make it a process to contact the Europeans every ten years to make sure they haven't moved to another practice. If you can't reach them, then discard what you're legally permitted to discard. Publish this policy.

> As for the case of destroying invoices, it's not that simple. The "invoice" would be the bill sent to the insurance company or patient including diagnostic and procedure codes, but the insurance companies may come back even years later for "chart review" on charges they've paid and in that case they're not looking for the codes they're looking for the supporting documentation in the patient chart.

You're not required to destroy invoices under the GDPR.

> Finally, regarding "enterprising" attorneys wasn't there a whole situation some years back where third party attorneys in Germany were going after alleged copyright infringers "on behalf of" companies that had never heard of them? My Google-fu failed me on this, but I didn't spend a huge amount of time looking. Is there a comparable risk here? I'm not worried about someone actually getting hit with a 10 million Euro fine, I'm more worried about that annoyance-factor "Remove my client's data from the data that you are required by law to keep, come to Europe to defend your failure to do so, or pay my client to abandon this action."

You would ignore such a claim.

In a legitimate claim, the person would complain to the regulators and the regulator would decide what action to take.

An invoice is either a contractual or legal obligation, which takes precedence over the data subject rights. Even if you are asked to destroy the subject personal information, that information should never be included and is against the law.

Reply on news.ycombinator.com