News for hackers. Stuff that matters.

A comment on GDPR: sorting the fact from the fiction. Parent comment

Re:GDPR: sorting the fact from the fiction by huehehue on Saturday February 10, 2018 @10:10PM (#16350970)
I'm still trying to wrap my head around the GDPR myself, but I think (and would love evidence to the contrary if wrong) that IP addresses, certain device attributes, and the like are okay if they're required in order to ensure (or protect against threats to) "the availability, authenticity, integrity and confidentiality of stored or transmitted personal data". [0]

I don't really know about relational data, where a true "delete" would destroy someone's database. Somebody told me that, if hard deletions aren't technically feasible, then soft-deleting (or marking as archived or whatever) is acceptable. Not too sure I believe them though -- simply replacing the sensitive data with garbage and keeping the relations seems like a better idea.

[0] https://gdpr-info.eu/recitals/no-49/

[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by geocar on Saturday February 10, 2018 @11:46PM (#16351250)
> Somebody told me that, if hard deletions aren't technically feasible, then soft-deleting (or marking as archived or whatever) is acceptable.

Just also remember to record that you shouldn’t restore that persons data to the pre-forgotten state.

The European courts haven’t weighed in, but they’re not unreasonable, and the UK has given specific guidance:

https://ico.org.uk/media/for-organisations/documents/1475/de...

[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by Silhouette on Sunday February 11, 2018 @04:59AM (#16352024)
The UK guidance you mentioned there appears to apply to the DPA (the current legislation in this area) and not the GDPR (the new legislation with the stronger rights for deletion etc.).
[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by geocar on Sunday February 11, 2018 @05:12AM (#16352053)
In what way do you think the GDPR right to erasure is “stronger”?
[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by Silhouette on Sunday February 11, 2018 @02:14PM (#16354215)
In that no directly comparable right even exists under the current DPA?
[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by geocar on Monday February 12, 2018 @04:26AM (#16357532)
That's not really how European law works.

huehehue was interested in what the GDPR might mean by erasure and deletion. This is the ICO's opinion about it. It'd be a surprise if they suddenly interpret erasure and deletion differently: There would have to be something in the GDPR that suggests that this isn't good enough.

[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by codedokode on Sunday February 11, 2018 @12:41AM (#16351373)
You don't need to delete personal information. Just replace all strings with XXX.
[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by rusk on Sunday February 11, 2018 @03:08AM (#16351730)
Yes. I think this falls under the term "proportionality"
[ Parent | on HN ]