News for hackers. Stuff that matters.
Re:Protecting GDPR Personal Data with Pseudonymization by madez on Thursday April 05, 2018 @05:52PM (#16769101)
A promise not to touch data is not a deletion. If you can recreate the private data from backups, you did not comply with the deletion request.
Re:Protecting GDPR Personal Data with Pseudonymization by ewjordan on Thursday April 05, 2018 @10:05PM (#16770382)
Most lawyers seem to be advising the opposite, though, and say that backups are ok - do you have some knowledge here, or are you arguing the spirit of the law?
Re:Protecting GDPR Personal Data with Pseudonymization by IAmEveryone on Thursday April 05, 2018 @11:06PM (#16770602)
Backups are fine because they are short-lived. You obviously have a reasonable amount of time to implement a request for deletion, say a week or two.

If you are keeping year-old “backups”, that’s actually an archive. The difference shouldn’t be too difficult to understand because year-old data is obviously useless if you have restore your database.