Re:Protecting GDPR Personal Data with Pseudonymization
by madez on Thursday April 05, 2018 @05:52PM
(#16769101)
A promise not to touch data is not a deletion. If you can recreate the private data from backups, you did not comply with the deletion request.
[ Parent
| on HN ]
Re:Protecting GDPR Personal Data with Pseudonymization
by ewjordan on Thursday April 05, 2018 @10:05PM
(#16770382)
Most lawyers seem to be advising the opposite, though, and say that backups are ok - do you have some knowledge here, or are you arguing the spirit of the law?
Re:Protecting GDPR Personal Data with Pseudonymization
by IAmEveryone on Thursday April 05, 2018 @11:06PM
(#16770602)
Backups are fine because they are short-lived. You obviously have a reasonable amount of time to implement a request for deletion, say a week or two.
If you are keeping year-old “backups”, that’s actually an archive. The difference shouldn’t be too difficult to understand because year-old data is obviously useless if you have restore your database.