Hacker News Reader

Comment by kaspm | Hacker News Reader

as someone who is debating how to handle right to erasure this is very interesting. I've also been struggling with how to automate erasure within in 3rd party SaaS tools that we use.

I think to count we have 34 SaaS products of which something like half of them contain our customers PII.

Is the regulation state that we must guarantee right to erasure or that we must make a reasonable effort to erase customer data on request?

Are people generally automating this fractal process or manually deleting from systems that only offer a manual process (such as Google Analytics)?

View on HN

You’re not allowed to store PII in Google Analytics already as per the terms of service:

You will not and will not assist or permit any third party to, pass information to Google that Google could use or recognise as personally identifiable information.

https://www.google.com/analytics/terms/us.html , section 7.

Even if you don't send personal data to Google analytics they store personal data automatically. At least Google Analytics for Firebase store the following identifiers: Mobile ad IDs IDFVs/Android IDs Instance IDs Analytics App Instance https://firebase.google.com/support/privacy/

But those can change and if you don't store personal information you can't relate to an specific individual.

> Is the regulation state that we must guarantee right to erasure or that we must make a reasonable effort to erase customer data on request?

The regulation does not say that this has to be automatic or instant - but if the request to erase comes in, you must be able to somehow do it. If it means a person going through admin interfaces of all 34 SaaS tools, that's fine. But in the end you have to erase all of it, "it would take unreasonable effort" is not accepted as a reason to refuse or skip some third parties where the data has been sent.

If the SaaS products don't offer permanent deletion options, then you can't send personally identifiable data to them in the first place.

A reasonable effort is to have an architecture in place that allows you to comply with the removal process. If that isn't the case, rebuild until it is.

Reply on news.ycombinator.com