Hacker News Reader

Comment by asdfasgasdgasdg | Hacker News Reader

Considering Google's data retention policies are GDPR compliant, things will be really deleted within a small N number of days from when they're "deleted." At least for European users, and I doubt they are maintaining separate policies on this front for other users.

Even in the extremely unlikely event Google was grossly out of compliance, the successor company would still need to obey the law or risk hefty fines, so it shouldn't really matter to you.

View on HN

I see absolutely no reason they would keep the same policy for regions that don't require it.

In fact, we're seeing that now with Facebook: every user outside the US/Canada was technically a user of Facebook Ireland, and when the GDPR came into effect, they all got GDPR rights (EU companies have to comply with the GDPR for all users, not just EU users).

Facebook's response was to move everyone except EU users off Facebook Ireland ASAP.

Because maintaining maintaining multiple codebases is inefficient.

Because making money off your data is their whole business model, they're very motivated to lose as little of it as possible.

they have dozens/hundreds of systems in different languages run by different teams. nothing was gdpr compliant 2 years ago. there's been a cost to move to that compliance. changing systems you don't have to is also inefficient. you'd need to weigh the delta between the inefficiencies, assuming that 'efficiency' was the primary goal in the first place.

Deleting data would not a separate codebase. It would literally be a few different functions that only get called if the country is in the EU.

Do you think they run a separate codebase for google.co.uk and google.fr ?

I've definitely seen companies having different policies. First, the data is valuable, so keeping it when you are allowed too can be worth it for that. Second, doing a full deletion can be costly in hardware resource utilization, and sometimes even involve some manual labor. So minimizing it can be cost effective.

GDPR doesn't require "real" deletion. You just have to make the data inaccessible

Citation needed.

I don’t have a citation handy, but solutions such as “encrypt hthhe data and instead of deleting the data trash the key” have at least been discussed for environments where actually deleting data is hard (event-based storage, cold long-term backups) etc.

From a technological perspective that data would be as good as deleted, even if strictly speaking it still exists.

Overwriting the data with random data is deleting it.

There’s no data being overwritten in the mechanism I described.

I believe his point is that in encrypting the data, you are overwriting it - with the encrypted version, which without the key is effectively 'random data'. It's not actually random though, so I don't agree that the data has technically been deleted. Do agree with you that it might as well have been though, so certainly should be good enough.

The idea is slightly different though: you encrypt the individuals data before it ever goes to permanent storage, backup or so. And when it’s time to delete that data, you discard the key instead, effectively making that data inaccessible.

https://eur-lex.europa.eu/eli/reg/2016/679/oj, the 26th section.

I think that covers what we’re talking about here. As in, it is ok to just delete the link between a real person to an anonymous key and not all their anonymised data. That allows one to avoid having to delete all the data itself (imagine how hard that would be from historical backups etc).

Like that text says, as long as a single person can be - even indirectly - identified from the data, it's only pseudonymized, and the GDPR protections apply. Even an IP address can be personal data.

wouldn't you have to know about the person in question first before you can 'indirectly' make the connection?

Yes, the point is also to limit "merges" of databases, which build extremely detailed profiles from seemingly inconsequential records. As the US Privacy Protection Study Commission wrote way back in 1977,

“The real danger is the gradual erosion of individual liberties through automation, integration, and interconnection of many small, separate record-keeping systems, each of which alone may seem innocuous, even benevolent, and wholly justifiable.”

https://ico.org.uk/for-organisations/guide-to-data-protectio...

Which links to:

https://ico.org.uk/media/for-organisations/documents/1475/de...

The data has to be "put beyond use"

As much as I hate to think about this - what's the probability that Google outlives the GDPR, current trends in privacy laws, or the European Union itself?

low

Legitimate interests are a potential backdoor to keep/sell customer data in the event of bankruptcy or ownership transfer. Provided legitimate interest can be argued, this would still be GDPR compliant. Given the potential value of the data, it's extremely unlikely that noone would try that in court, and before a final decision is made (which could take years), nothing would be deleted.

To the downvoters: note that I don't argue that it's actually a legitimate interest with respect to the GDPR, only that a third party looking to acquire (parts of) Google is likely to find it worthwile pursuing the chance that it is. This setup will lead to data being retained for longer than a couple of days.

Reply on news.ycombinator.com