Hacker News Reader

Comment by markstos | Hacker News Reader

You can hire one or more data privacy people whose whole job it is to track this. They get an inventory of all the systems and talk to the managers of every system, find the answers and document them.

Meta is choosing not to know or pretending not to know. They have the resources to know where your data goes.

View on HN

I think you are underestimating the complexity of this task by about three orders of magnitude. This is the way to do it, but you can't do it for a company of this scale with a handful of people.

But pretending they can only afford "a handful of people" to work on the problem is a little silly, too. They don't have the answers because they choose not to devote the resources to get the answers; not because they are unable to devote the resources.

I agree with that. Companies like Facebook should have a large org responsible for this problem. My point is that the problem is way more complex than some might think.

Agreed - when I worked in the financial industry there was something called data lifecycle management. Since keeping data around indefinitely meant you could be held liable at any time for anything that happened in the distant past, companies are motivated to track data and delete anything that's no longer necessary for business as soon as possible.

No such law exists for Facebook, so they don't care. Someone needs to pass a law with a big fine attached and then things will change.

it's also way simpler than some might think, in that it's simply a matter of Facebook choosing not to devote enough resources to it, and thus choosing not to know

Not my problem of how many people because of evilCo's size. That's their problem, and I shouldn't even be aware of it being a problem.

Then, first and foremost, it is the task of these people to bring down the complexity of the task. You can't reason your way out of legal obligations by throwing your hands up and saying it's too hard.

Hiring one person to do this at a company this scale, will give you results in the next decade. BTW, when the report is complete, it will no longer be accurate. Sure you can scale the process by putting more people on it, but it won't scale linearly. Additionally you will need buy in from all the system managers to dedicate time to assist the new data privacy team. It is doable, but comes at a cost.

I mean, I've worked with those teams for GDPR stuff. They have no context, and no access or ability to trace data flow, so they often write up very partial and incomplete reports because no one else cares particularly deeply about the problem.

Reply on news.ycombinator.com