Hacker News Reader

Yes. Forget about just not rendering the data in projections. Article 5.1e states: “Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed [...]”

Article 5 contains concrete rules and also sets out the basic principles.

In short, you must be able to remove all information that may enable you to “single out” an individual (a physical individual by eg name or an online identity such as a particular web visitor by eg a cookie id).

So, if you're building your infrastructure in a way that you need to access a separate datastore to discover which individual is linked to which event in a stream. Then, leaving the stream of event as it is, but removing all referred keys in the joined datastore would be "GDPR-compliant"?

It’s easy, but poses massive problems in the public sector or finance. Say you’re terrible at paying your dept, but manage to do so 10 years late.

Now your transaction is complete and you have the right to be forgotten, but I wouldn’t want to ever lend you money again. How do I keep that record?

You take Art 6 (f) of the GDPR. You write down that your processing is necessary for the purposes of the legitimate interests pursued by you. E.g. I don't want to lend money to a you ever again.

But to identify you and not mistake you for someone I need to keep information like Name, Passportnumber and a reason why I put you on the list in first place.

Now you can keep these information.

But the important point: you can only use that information for that purpose. No "oh well, now that we can keep it, let's use it for marketing and such".

Good point!

Looking at Recital 50 there may be possibility to use information for other than the original purpose if the new purpose is compatible.

But another interesting thought: Can Marketing hold as a legitimate interest?

Lets look at Recital 47: The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

Interseting finding you think. Reading this again the word may is striking. Ok this is not a Carte Blance. And since there is Recital 70 which states:

"Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information."

So where does this leave us: Yeah we can use Data for Marketing and it well may be a legitimate interest of a company. But we will have to inform the data subject that it can object the usage.

Yeah, not really. Recital 47 says "may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding".

If I ask to be forgotten, my interest is that my data is no longer used, and your legitimate interest in holding on to it to avoid lending to me in the future does not override that for any other purpose.

That is right, and I guess it would count as objection to marketing.

Well, what about stuff like this: http://www.bbc.com/news/technology-43752344

Aren't there provisions for things like back-ups and other stuff that you can reasonably expect not to turn up later? I would think data in the event store but not in projections could be considered as such, to some extent.

I should disclaim this with: I've only spoken to people who have looked into this. I can't guarantee it's correct, but it's the situation as I know it currently. It's also assuming cold backups that are not processed in any way that accesses the should-be-removed data

You don't need to remove data from backups in realtime but you do need a system in place to re-delete data after a backup restore that previously had a removal request made against it.

From what I've heard so far the best method is some form of GUID that means nothing when there's no data attached to it but can be used to identify user records that need removing if they re-appear during a backup restore

Naturally, you'll want to make the please-delete-these-GUIDs table more redundant than the rest of what you've backed up

There’s no distinction between storage and backup. Most large backup companies are developing fixes for removing data in backups.

Makes me wonder about block chain data that can't be deleted

If you put PII on the blockchain then God have mercy on your soul when the regulators find out...

Can a malicious actor put PII (or copyrighted/otherwise illegal works) onto a blockchain to "kill" it?

There's apparently all sorts of illegal stuff embedded in bitcoin metadata

An uncensorable, global, distributed data store opens up all kinds of possibilities for weaponizing data. If you're intending to blackmail* someone by threat of doxxing, threatening to put their information on the blockchain is much worse than simply putting it on pastebin.

People have also attempted to use blockchain data for coercion. For example some folks were worried about the centralization of Bitcoin mining in China, so they posted information about Tiananmen Square on the blockchain, hoping the Chinese government would simply ban Bitcoin.

*blockmailing them, if you will.

That's quite simple - as a controller holding my data, you're responsible for safeguarding the data and fulfilling the requirements, so if putting that data on a public blockchain makes it impossible to do your duty, then you're not allowed to put that data on a public blockchain.

If I put my data there, that's my problem, but you're not allowed to do that.

> If I put my data there, that's my problem, but you're not allowed to do that.

is it really? that's a part I did not really understand about the regulation and can't find anything about voluntarily relinquishing control of personal data.

i.e: I leave my personal name and email address on a public forum. Google later add that post to it's index, or another random company like Web Archive or archive.is scrapes it.

What are my rights? What are their obligations? is the forum owner liable for my action if I didn't explicitly agree for my data to be shared by him to all unforeseeable future scrapers?

> as a controller holding my data, you're responsible for safeguarding the data

this confuses me even more. say I'm running an analytic system. I track users trough a cookie. tracking cookies are, for some reason, personal information. if an user delete the cookie from their browser and then ask to fulfill my obligations about erasing his data from my system, how do I identify him? who's liable then?

The last part of your question is easy to answer. Before you start processing personal information, you need to ask the affected persons for consent. So now you know how to identify them.

If you want to get away without consent, you need to design your system in such a way that it doesn't hold personal information. E.g., maybe randomize the raw tracking data as first processing step, and only keep the randomized version.

> I leave my personal name and email address on a public forum. Google later add that post to it's index, or another random company like Web Archive or archive.is scrapes it.

I wish there was an official guide on how to run a forum properly, because all forums suffer from the same problems.

What I figured out so far:

You as a forum administrator must delete that personal data on request. This could mean digging through all posts of a user and delete all PII, although you don’t have to delete all posts if they contain no PII.

You as a forum administrator must get your privacy policy right and possibly make it harder for third parties to index PII. This depends on your intentions and whether or not people know that your forum is public.

Say, your forum is about car parts. You could set a subforum that asks members to introduce themselves (where PII are most likely) to noindex or hide from the public.

This way, you’ve put in reasonable effort to protect your users and your obligation is done. Indexing by third parties is now out of your control.

But say you run a medical forum where people post health data (considered super sensitive) and are expected to post a lot of PII, you might have to set the entire board to ”members only“.

Although I’m not sure about any of this and to some extend, most forums provide value by being visible to visitors and indexes by Google. Quite sad.

IMHO this is not talked about much because that's not a new GDPR issue; GDPR introduces a bunch of new things about e.g. consent of processing data, but the "right to be forgotten" and requests to delete my PII that someone else posted to your forum is pretty much unchanged, it was a thing in EU legislation for quite some time already (might be a full decade?) so all the "here's what to do now" articles don't touch this.

digged a little into this.

art 17 relevant excerpt seems these:

> the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure

so it seems a "disallow" in robots would solve the issue with crawlers and public data, but that works at page levels, not content level. pushing a crawl request after information erasure may not be enough, since we need to inform the controllers on why the data has changed, not just that it has changed.

What if your data was put their before the law was passed?

Will you be doing any processing on it after the law is passed? If you do, you certainly fall under the law. If you're not doing any processing and you don't have a legal obligation to hold the data, why are you?

(Also you probably need to demonstrate that you have consent to hold that data in compliance with the law. But I'm not entirely sure on how that applies to pre-existing holdings.)

The general approach for using a blockchain with personally identifiable information seems to be storing only that something happened, not exactly what. Effectively, this means storing only a resource-local identifier, some metadata (e.g., 'UPDATED RECORD'), and a reference to the database were the actual data is stored on the blockchain.

Your right to be forgotten is balanced against a business’s right to make money, and society’s right to remember. I imagine that a court would consider a whole range of factors in weighing that balance.

How much real harm was done to you? How expensive would it be for us to delete the data? What steps have we taken to protect your privacy?

I highly doubt that the courts will see it as black and white as you suggest.

That is nonsense. The right to be forgotten is EU law, enacted by the EU parliament, enforceable by EU court. Article 17 of the GDPR.

There is no "right to make money" or "right to remember" in this sense at all. You can argue that there is a public interest in allowing people to make money, and a public interest in remembering, but the place where these interests are weighed is in parliament. Not in courts.

> There is no ... "right to remember"

To quote Article 17.3.d:

> for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing

In fact the whole of Article 17 contains exceptions to the right to be forgotten.

Meanwhile Article 16 of the EU Charter of Fundamental Rights (enacted 2009) is the "right to do business", and some of it conflicts with GDPR.

All legislation is interpreted by the courts. It's very rarely as simple as "the law says X, therefore you are guilty. Case closed." Instead, lawyers argue about conflicting legislation, and previous cases. A judge weighs all those arguments, and gives a decision, which then affects other future cases.

I am not a lawyer, but I have spent quite a bit of time working with lawyers to comply with GDPR. What I have said here interprets their words.

Yes, so there is no "right to remember" and the right to do business is not the "right to make money" doing business. So you're at the very least misquoting your lawyers.

17(3), and in more detail 89(1) closely circumscribes the scope of exceptions. Specifically in the context of the post you replied to: There is obviously no public interest exception that would allow you to keep the data around because a specific technical implementation becomes more convenient/cheaper if you do.

I suspect you're going to be very disappointed by the outcome of the GDPR.

>A judge weighs all those arguments, and gives a decision, which then affects other future cases.

Careful. This is not common law jurisdiction. Case law doesn't apply here, and the ECJ rulings themselves have the primary interpretative function, not the arguments of lawyers.

Thank you, I'm out of my depth in explaining the difference.

Would it be sufficient to scrub the event log of PII so you don’t have to break as much of the object graph in the read model?