News for hackers. Stuff that matters.
Re:GDPR for lazy people: Block all European users with Cloud... by hk__2 on Friday May 25, 2018 @07:49PM (#17159142)
> Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong.

Erase the name and address fields from the user in the database. You don’t have to delete any line, and that person doesn’t have any personal info in your database anymore. Problem solved.

Re:GDPR for lazy people: Block all European users with Cloud... by alwaysdoit on Friday May 25, 2018 @08:21PM (#17159284)
Two days later the customer files a chargeback with their credit card company and the credit card company wants you to provide documentation for the transaction.
Re:GDPR for lazy people: Block all European users with Cloud... by ATsch on Friday May 25, 2018 @08:39PM (#17159371)
Then you have a legal obligation to keep the data, which counts as one of the valid reasons for keeping it, AFAICT.
Re:GDPR for lazy people: Block all European users with Cloud... by alwaysdoit on Friday May 25, 2018 @09:03PM (#17159464)
Credit card company is not a government. It's helpful for business purposes to have records, but it's not always a legal requirement.

Anyway this stuff is super complicated and there's no rollback for data that was mistakenly deleted and shouldn't have been, so the point is there are layers and layers of complications and scenarios and it's not as simple as everyone likes to make it out to be. It's not impossible, but it's definitely a lot of difficult work.

Re:GDPR for lazy people: Block all European users with Cloud... by spamizbad on Saturday May 26, 2018 @09:23AM (#17161869)
IF my understanding is correct, you can actually keep a denormalized version of user information (name, shipping info etc) and still be compliant, assuming you do not use that billing information for any purpose other than billing.

The "right to erasure" isn't as strict as the "right to be forgotten" -- You (the end-user) would need to prove that merely having your name and address in billing records violates your right to privacy. And to make that argument you'd have to provide evidence the business is using said information for purposes other than billing.

Personal data can be used lawfully to "fulfill contractual obligations with a data subject" (eg: fulfilling a purchase, and retaining information for warranty/returns/RMA etc purposes) and "To perform tasks at the request of a data subject who is in the process of entering into a contract with the controller. " and "For the legitimate interests of a data controller or a third party"

Re:GDPR for lazy people: Block all European users with Cloud... by cromwellian on Friday May 25, 2018 @08:02PM (#17159195)
Assuming the remaining data can't be used to deanonymize them. This solution buys into the myth that anonymizing data protects PII.
Re:GDPR for lazy people: Block all European users with Cloud... by TeMPOraL on Saturday May 26, 2018 @01:45AM (#17160440)
"Anonymizing" would be replacing each user's PII with a value that's unique to that user. Instead, you could just blank it out or overwrite with universal "data removed because of GDPR" token.
Re:GDPR for lazy people: Block all European users with Cloud... by cromwellian on Saturday May 26, 2018 @04:12AM (#17160817)
That highly depends on the DB used. If you're using a log structured database, it's possible the original data could still be there. Immutable databases that never delete or overwrite entries exist.

And what if the PII is stored in a blockchain? Then what?

Re:GDPR for lazy people: Block all European users with Cloud... by TeMPOraL on Saturday May 26, 2018 @05:48AM (#17161160)
> And what if the PII is stored in a blockchain? Then what?

No clue. But I can't wait for that to be tested, because I'm very curious what the solution will turn out to be.

Re:GDPR for lazy people: Block all European users with Cloud... by cabaalis on Friday May 25, 2018 @08:01PM (#17159194)
Mostly solved. Anonymized data sets can sometimes be de-anonymized if the conditions are right and external factors can be applied.