Comment by eb0la | Hacker News Reader

Comment by eb0la | Hacker News Reader

Consult your Data Protection Officer first.

GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available.

If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform).

Setting something to "deleted" might not be the best way to do the actual soft delete.

Sometimes you can "delete" that user moving it to a separate part of an LDAP branch (where nobody except someone with authority can access).

In other cases, you can add the "deleted" flag on the table. If so, MAKE SURE your app access the data from a view of the table where the 'deleted' users are not present. Even better: partition the underlying table based on the "deleted" field to physically separate active and deleted users.

But whatever you do, ask your Data Protection Officer first.

I'm going to go out on a limb here and guess that 99% of the companies out there affected by the GDPR and the OP in particular do not have a DPO (yet), and may not realize they need one, and even if they do know that then they likely won't be able to fill the seat either in time or with someone competent.

Every year we look at quite a few companies, this is the first year that I've spotted a DPO in the wild, and impressively, they even knew their stuff.

Not every company needs a DPO though, e.g. check here:

https://www.eugdpr.org/key-changes.html

Maybe his company doesn't need one. Of course, whether he has a DPO or not, still the question remains of how to "properly" delete the personal data.

It is quite well possible their company does not need a DPO. But given the nature of the question there is some evidence they do, besides that hiring a DPO is not something done in isolation but most likely as as the result of a GDPR impact study done in ... 2017 or so, which I'm going to again guess was not in the cards for many companies.

So, in summary: likely the vast majority of the companies affected is only now starting to wake up to the fact that they are affected, for quite a few of these companies the effects will be relatively benign unless their servers are compromised, for the more serious offender and the larger companies that have not yet started to address these issues it is likely too late to get anything done in time but since this goes for the vast majority of them they are simply playing a complicated game of Russian roulette with the oversight bodies and a couple of them will undoubtedly get lucky to great relief of the remainder.

Data protection authorities tend to be vastly understaffed, but this too will hopefully change in the future.

Yeah, I agree with everything you said.

It would be interesting to know whether the big companies have addressed (at least partially) their GDPR compliance. Maybe they do just "play Russian roulette" like you said, and hope for the best.. Of course, implementation guidelines are not yet fully defined (like WP29 opinions, some of them will change, even then, those opinions are not legally binding).

From what I've seen it strongly depends on the vertical but there are outliers both ways. With medical and fintech (banks, IPSPs, insurance) you can expect they are on average doing ok though there are some bad counterexamples. E-commerce is only just now starting to wake up and everybody else is going to be playing catch-up for the next couple of years.

Note that my sample is relatively small and mostly western European countries (nl, be, de, uk).

Is there anyone reading this whose company has a DPO already? Is it an internal or external person? How technical are they? I'm a developer and I have a law degree; would that put me in an advantageous position to become one? Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed? Or do the big consultancy firms have the GDPR market cornered already? I wouldn't want to go in a direction where I would become what today's 'security auditors' do - go through a checklist of mostly irrelevant topics, drum up a list of 'recommendations' that usually aren't relevant or misunderstanding the situation but nobody cares anyway because it's all just busywork to get 'certified' for this or that (or insurance requires it). But if it would be actually working with technical teams on questions like this, that would be interesting.

> Is there anyone reading this whose company has a DPO already?

I've seen one in all of 2017 (out of ~20 companies).

> Is it an internal or external person?

In that case it was internal

> How technical are they?

More legal than technical, but that's a very small sample.

> I'm a developer and I have a law degree; would that put me in an advantageous position to become one?

Yes. In fact that's probably one of the most lucrative combinations of fields.

> Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed?

YES! In fact if you are halfway decent this would be an extremely lucrative thing to do, but it probably will become less so over time as the knowledge gets diffused.

Yes, but it was a token gesture to DPA and in reality

1) It was not their main role

2) It was a token gesture, someone to address post too!

Every consulting firm I know is trying to sell GDPR services atm...

THe answer varies depending on the size of the company. However, I have seen many IT related professionals taking over the GDPR issues. In larger companies it is a more legal role. As to your career question: We are currently involved in many different and exciting project that push the boundaries of law and technology with respect to data protection. Currently, everyone is a GDPR consultant but quality and nature of the work differ substantially. For most part it is an exercise in producing documents and procedures to prove compliance. However, when it comes to implementing technical solutions you can really stand out. So if this is an area that you are interested in you should move fast. There is also a growing number of international opportunities as even non-EU companies require GDPR experts.

My employer (3000 employees, medical research) has an internal DPO. I only dealt with him once but was impressed with his technical as well as legal knowledge.

As far as I know the data must be properly deleted not just marked as deleted. Essentially you can zero out all fields which include personal information. Keeping the data as soft deleted you still risk it in case of a leak due to a hack.

Reply on news.ycombinator.com