Hacker News Reader

Comment by vincvinc | Hacker News Reader

IANAL, but isn’t "true deletion" legally required under GDPR?

Wouldn't leaving personal data lying around in your database like this technically leave you liable to massive fines?

AFAIK GDPR mandates that deleted data is no longer processed (used for marketing, analyzed, etc). I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry.

Furthermore, I'd imagine that the host might be required to retain those records for law enforcement purposes (imagine if someone made death threats, etc and law enforcement requested those records for an investigation).

GDPR does have exceptions for legal compliance, yes. If someone does something illegal and they request deletions you can (IMO, not a lawyer) retain the records if you know there is an investigation or court case going or strongly suspect so or initiate it yourself.

You may even be able to keep comments/posts for longer for general compliance. You will need an audit explaining why and to be prepared to defend it. You won't be able to use such data for analytics.

This is based on my personal layman's understanding. I am NOT a lawyer. I am NOT your lawyer. If you need legal advice consult a competent lawyer in your jurisdiction.

Legal/Regulatory compliance is not for Facebook or Amazon.

It is to prevent people going to their Bank, where they have a credit card or a consumer loan, or a mortgage, and say "can I please be forgotten/be wiped from your systems - oh and the loan too!".

> I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry.

You just store the keys separately, assuming one-way encryption (losing the key) counts as deletion.

IANAL - no idea what "erasure" as in the "Right to erasure" means http://www.privacy-regulation.eu/en/article-17-right-to-eras...

But... if deleted data is no longer processed, does that mean it can not longer be used for targeting etc?

It means deleted as in gone.

Your backups should be cycled after a few months and the deleted data will eventually not be present in any backups.

There’s a bunch of cases where a business should not delete data even if requested by a user; the biggie is crime/fraud prevention. However, if that data was later disclosed in a breach the company would be subject to penalties. The request for removal does count as rescinding consent, so you would no longer be able to do anything that required consent anyhow.

Data could be thought of as radioactive so long as it has a unique identifier. If you can aggregate your fraud detection data in some way to remove the pseudonymous/personal identifiers then you should. If you can’t, then your usecase needs to justify the risk of keeping that radioactive material around.

Watch out that your aggregates can’t be reverse engineered though. There’s a reasonableness test around how easy it would be to recompile a users profile etc. As technology advances things that were once unreasonable become reasonable think md5). I find it helpful to think of reasonableness being connected to the best 10 people you recently interviewed, or the actions of any competitor in the space. If a prosecutor can point to the competitor and ask why you didn’t do what they did, you need a very good reason to pass reasonableness.

Prove we didn't delete it.

It would be extremely risky for such a huge company to pull a stunt like that. All it would take is for one employee to become a whistleblower to put the company into a legal and PR quagmire. And all that for what? Losing 0.1% of their data because of people deleting their account? Not worth it IMO.

In which event Huge Company finds the lowest level employee they can reasonably pin the blame on.

But they still get fined 4% of their global revenue. A few $1.5bn fines and they'll learn how to delete.

I haven’t read the relevant (proposed?) legislation, but aren’t these sorts of penalties usually written as ”fines up to x”?

The EU has recognized that a 200 million fine won't hurt facebook. Instead it says "fines up to X€ or Y% of global turnover, whichever is higher."

I also strongly suspect that in cases like FB or Google, the judges will happily go for the 4% mark if possible.

Ok, great thanks for clearing that up.

Yes, this is a good thing, in opinion. There was a case where a Finnish man was fine 54,000 Euro for speeding, where the fine is calculated based on income[1]. I think this seems like a reasonable way of metering our penalties.

It seems reasonable to me companies should be treated in a similar manner.

1. http://www.bbc.com/news/blogs-news-from-elsewhere-31709454

Atleast for regulations like these, yeah. Big corps like facebook don't care if they get hit with 200 M€. 4% of Facebook's global turnover however...

I'm sure the EU will find some way to spend 2 billion € for something useful. (13% of their net income btw)

Yes. A minor technical cockup when the company is attempting to meet the spirit of the law wouldn't be treated as harshly as a systematic failure, or a deliberate attempt to work around the spirit by following the letter.

If facebook discover a backup from 2012 on a tape that hasn't had items deleted, and adapt their processes so it doesn't happen again, they won't be hit with a $1b fine. If they deliberately refuse to delete people's data as a policy, they will be.

This one is at least...

Maybe I'm naive but I'm not sure how you could spin something as fundamental as "deleting does not actually delete anything" as the work of one rogue employee. What would said employee have to gain from it anyway?

I'm sure Facebook would do anything it could to work around these regulations and lobby as much as possible to have them overturned but I doubt they're reckless enough to simply ignore them and hope for the best.

Pretty easy. Develop code to delete. Code doesn’t work as “designed” and just makes the qc/qa think data was deleted. Automated analysis keeps using it.

No human ever directly accessed data so they don’t “know” it exists.

Ad targeter or whatever needs the data keeps working.

This seems like a trivial programming problem. I’m confused by the confusion.

You need people to develop and maintain this code, and it touches many aspects of architecture. Keeping it contained to a small team and avoiding any leaks doesn't seem trivial to me. What if some dev not in the know notices the issue and submits a fix or a bug report, what happens then? You introduce a pretty big management liability in your management if you need to protect yourself against your own employees. And what if the employee(s) you chose to throw under the bus in case the trick gets noticed decides to rat you out anyway, for fame, money or to avoid repercussions? How do you even find engineers willing to do something so unethical without raising suspicions in the others?

And again, all that for what? Keep profiles on the small minority of users who bother to scrub their profiles, even though these same users are probably not very good targets for ads in the first place? I don't think it would be very rational for Facebook to try something like that unless they're trying to be evil for the sake of being evil.

It would require a whistleblower, which could definitely happen.

Especially if they give a percentage of the fine to the whistleblower.

1% of 4% of Facebook's annual revenue sounds like a good deal to me. Who wouldn't be a whistleblower for $15MM

Prove a negative?

The onus should be on you to prove you did.

Yes.

Reply on news.ycombinator.com