Wow, that last one is surprising. I understand that it can be a hard problem to fully delete data if you haven't built systems with that in mind from the start, but isn't that (not deleting backups) a flagrant violation of GDPR regulations?
Even in situations where a data subject can request it (which isn't all of them), a Controller can choose not to delete any data where they have an Overriding Legitimate Interest. That's legalese for "a pretty good reason," as long as the privacy interests of the data subject are taken into account. Fraud detection is explicitly listed as an example of Overriding Legitimate Interest.
I'm not aware of any court action confirming this, but the general sentiment is that "altering back-ups is a terrible idea" is a valid Overriding Legitimate Interest, so long as you make sure that you can re-erase the data subject's data after restoring from back-up. The data subject's privacy interests are generally satisfied because the back-ups are not used for processing.
Other considerations like data minimization still apply, so even if you have Overriding Legitimate Interest for some data that doesn't give you carte blanche to horde all data. But things like logs (with a sane retention policy), back-ups (with a re-erasure process), and trained ML models are generally allowed to keep remnants of your data around.
The wording about overriding legitimate interests is specifically in the case of erasure because a data subject objects to processing. It doesn't cover any of the other cases where erasure is required, any one of which is sufficient. One of those is "the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed" and another is "the data subject withdraws consent on which the processing is based according to [cross-references] and where there is no other legal ground for the processing".
There may be legitimate interests in things like maintaining logs and back-ups, but it would be quite a stretch to argue that an organisation with the resources of Facebook and the potential amount and sensitivity of personal data Facebook are dealing with can't manage to delete the underlying data in as long as 3 months.
https://datacenterfrontier.com/inside-facebooks-blu-ray-cold...
In this situation, however, we are talking about an organisation whose entire business model is built on personal data given by literally billions of people over a period of many years, with tens of thousands of employees and tens of billions in revenues, which is operating on a scale where it is demonstrably capable of designing and building replacements to its own specifications for standard infrastructure and deploying them throughout its own data centres. I don't think it would have much credibility if it claimed it couldn't guarantee to comply sooner than three months after a request because it regularly backs up possibly the largest database in the world on magnetic tape.
> What happens when you delete: We’re providing more detail about what happens when you delete content you’ve shared. For example, when you delete something you’ve posted, it’s no longer visible but it can take up to 90 days to be removed from our systems.
FB has previously published notes about backups, such as https://www.facebook.com/notes/facebook-engineering/under-th..., which include sentences like "Our job is to keep every piece of information you add safe, while ensuring that anything that's been deleted is purged in a timely manner".
I work for FB.
Passing data on to third prties without explicit consent from the user is a violation.
However, you can’t even use FB without giving such consent, or, rather, without being forced to give it through dark patterns and vague wording. The way FB collects consent is a violation.
Question is, who will bring the hammer down.
The data processor needs to make sure old backups are deleted in a timely fashion, and also need to make sure that data that has been deleted will be deleted again, should the need to restore the data arise.
And even that isn’t enough for the case where a user deletes part of their data.