News for hackers. Stuff that matters.
Re:Apple requires account deletion within apps in AppStore s... by vineyardmike on Wednesday October 06, 2021 @03:53PM (#28777583)
Can you just delete the key and local data? Is the requirement to push that deletion to all other SSB instances?

Seems like a case where in 2021 this rule is good, but blocks the creation of new business/product/tools that don't confirm with the 2020 way of thinking... which is good for apple.

Re:Apple requires account deletion within apps in AppStore s... by arkh on Wednesday October 06, 2021 @03:57PM (#28777626)
> Is the requirement to push that deletion to all other SSB instances?

Well if you follow the GDPR: yes. Article 17.2

> Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Re:Apple requires account deletion within apps in AppStore s... by jaywalk on Wednesday October 06, 2021 @04:03PM (#28777703)
If the personal data is encrypted and you destroy the only key that can be used to decrypt it, is it still personal data? Or is it now simply some random bytes?
Re:Apple requires account deletion within apps in AppStore s... by mike_d on Wednesday October 06, 2021 @06:13PM (#28779155)
I had this exact question for our privacy legal team and the answer I got was that deleting the keys to encrypted data is legally equivalent to deleting the data itself.
Re:Apple requires account deletion within apps in AppStore s... by cygned on Wednesday October 06, 2021 @04:14PM (#28777846)
We built a system that creates backups of PII using that mechanism; throw away the key after data is supposed to be deleted. That is legal under EU GDPR.
Re:Apple requires account deletion within apps in AppStore s... by arthur_sav on Wednesday October 06, 2021 @06:09PM (#28779108)
What's funny is that all these laws and (appstore) rules are not very well thought.

It comes down to the individual to interpret and enforce a solution that may or may not be in compliance.

It's like doing taxes in the US. You may or may not doing it correctly and you'll only find out if they start knocking.

Re:Apple requires account deletion within apps in AppStore s... by vineyardmike on Wednesday October 06, 2021 @07:18PM (#28779714)
> taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

This is just not possible for a lot of data like SSB.

How would you do this if someone asked github to delete all their commits across repos?

Re:Apple requires account deletion within apps in AppStore s... by arkh on Thursday October 07, 2021 @03:36AM (#28783316)
Commits are not personal data in the GDPR sense.

> For the purposes of this Regulation:

> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Re:Apple requires account deletion within apps in AppStore s... by 3np on Thursday October 07, 2021 @04:03AM (#28783464)
Are you certain that an app developer for a client would qualify as a Data Controller here? As long as the relevant data never passes through their or other third-party servers and it's strictly local account setup interfacing with SSB I think they are not?