Hacker News Reader

Comment by EdwardDiego | Hacker News Reader

How do you mean?

Let’s imagine you’re a modern bank and associate card transactions with the merchant.

Even if you sanitize/delete the account holder record, you can’t delete the transactions themselves (as it would screw up your accounting) nor the merchant association.

Now let’s say you have a very particular customer that always goes to a very specific restaurant at pretty much the same time every day consistently.

That pattern alone is enough to single out that particular person (and deanonymize them by correlating with other records such as cell phone location data, etc).

A bank would entirely be entitled to keep the info around. All information that must be retained by law (such as receipts, financial transactions etc.) is exempt from the GDPR and you cannot ask for deletion. You can ask that the holder of that information does not use it for purposes other than the ones covered by law, but that’s the full extend of it.

The same principal about foreign key relationships could be applied to messaging apps, restaurant booking services or anything else where a user's relationships with other entities/users would allow them to be identified.

The posting I responded to was about a case where the transactions themselves cannot be deleted since they must be retained for accounting reasons, so the same reasoning applies here: If they need to retain the messages/bookings/... for legal/accounting reasons, then they're exempt. If they don't need to retain them, they can just delete them.

The banking example was a bit muddled because it mixed the necessity of deletion with the method of deletion.

Wherever possible a business should delete relational data upon request. However, relational data is special because it cannot be effectively deleted by overriding user data with random values as Confluence seems to do.

Even if banks were allowed to delete customer data, they would face the same problem as social or booking services in that their relational data must be truly 'removed' rather than just overridden.

Ah yep, thought that was the case, thanks for clarifying :)

Banks are also regulated by financial crime regulations, which take presence over GDPR. There is an obligation to preserve data for a period of time (years) for this purpose.

Is this based on your interpretation of GDPR, or legal precedent?

The former - my understanding is that anything that can be used to identify a user is considered personal data, so even things that would be benign/meaningless in isolation would count if they produce a unique enough signal when aggregated.

Given that 99% of GDPR stuff goes unenforced, presumably it's the former.

If you understand the GDPR exclusively based on legal precedent, you'd probably conclude the GDPR doesn't exist.

GDPR creates a legal liability. It's less about enforcement and more about litigation risk.

The risk is very minimal or non-existent in the current situation though. Maybe once Google or Facebook is properly fined (with those 4% fines everyone was fear-mongering about) then you'll have to reevaluate, but given how it's gone so far I can't see that happening ever.

Reply on news.ycombinator.com