Hacker News Reader

Comment by Silhouette | Hacker News Reader

Someone says "delete me and my purchases", so you do

In many cases, that will be your mistake. The right to erasure is not absolute, and if you need to keep those records for a good reason -- for example, as evidence to support tax returns or defend chargebacks -- then you are entitled to refuse to delete them and to continue processing them for the necessary purposes. Otherwise mortgages would suddenly become a very fast way to send lenders under, since everyone could just demand they delete all identifiable records of who owes them money...

View on HN

Great, so now we get to spend money on lawyers and time in the courts to decide what information falls under “OK to keep for a good reason”

I couldn't agree more. The rules about erasure are full of holes like this. So are the rules about legitimate interests. And those represent, respectively, probably the most significant new subject right and probably the most common lawful basis for processing that isn't strictly necessary for some sort of legal compliance.

A simple example: another law requires it.

Your bank's requirement to verify a chargeback is not a law. It's a business contract.

And therefore saving the data is allowed.

Not necessarily. The performance of contract basis under the GDPR is for contracts with the data subject. You can't just agree a contract with some arbitrary third party and use that to circumvent any subject rights you don't like.

For data processing purposes like this, you will normally have to rely on the legitimate interests basis. That's the one with the almost entirely non-specific definition, combined with the almost entirely non-specific balancing requirements.

With a case like defending an unjustified chargeback, we might assume that the interest is surely both legitimate and overriding, but even that is only a personal view and not something any regulator has explicitly addressed in guidance, as far as I'm aware. In any case, plenty of other scenarios won't be so black and white.

No, if you say you need the information for tax purposes (say) then the user will complain to the data protection authorities. These authorities will then accept or reject the complaint, and if accepted will help you to come into compliance.

The trouble is, that's an assumption on your part, and it might not be a valid one. We have no idea yet how 28 different regulatory authorities will handle this sort of situation, or how much of an effort they will expect controllers and processors to make on their own if they are to receive the benefit of the doubt. And even if everything you assume proves to be correct, any formal interaction with authorities is stressful and expensive for a small business with limited time and resources available, and being confident that you aren't doing anything wrong in the first place is obviously preferable.

Reply on news.ycombinator.com