News for hackers. Stuff that matters.

A comment on GDPR: sorting the fact from the fiction. Parent comment

Re:GDPR: sorting the fact from the fiction by tyler_larson on Sunday February 11, 2018 @01:31AM (#16351491)
Encrypt all person-specific data with the a key unique to that person, and if the person requests deletion, delete the key. This effectively deletes all backups.
[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by mappu on Sunday February 11, 2018 @01:54AM (#16351546)
Help me understand - that seems like it just centralizes the problem. Since the key is now PII-equivalent, how is the key storage backed up?
[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by the_mitsuhiko on Sunday February 11, 2018 @04:14AM (#16351898)
Revolving backups and you throw away old ones. After 30 days or so theast traces of a customer’s keys will be gone.
[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by mappu on Sunday February 11, 2018 @03:51PM (#16354726)
In that situation, the data is "inaccessible" but a data breach during the backup retention period will still leak their details.

We can already achieve that result by removing records from the live DB and ignoring the whole backup situation.

So what has this separate encryption process achieved?

[ Parent | on HN ]
Re:GDPR: sorting the fact from the fiction by the_mitsuhiko on Monday February 12, 2018 @02:44AM (#16357174)
It has achieved that within a time frame PII of a user are removed from backups.
[ Parent | on HN ]