"everybody was expected to do all roles"
If it's everybody's job it's nobody's job.
16426 posts • joined 16 Jun 2014
"The data in company A's backups is not indexed in any meaningful way in the current schema"
You've merged the data into B's schema. Why are you keeping backups you can't use?
"Again, the de-dupe and merge processes make automatic deletion of restored data effectively impossible."
Why is it impossible? Haven't you indexed it? On de-dupe you already deleted an entry so why should deletion of another be a problem?
Both your examples are, in fact the same: merged data sets. If the merged data set is usable it would need proper indexing and should, therefore, be possible to delete as required.
"Erm, yeah, but I've deleted everything about Joe Bloggs of Wankstain, Essex, including his request to be deleted."
Two points. If you have some central record ID and that gets used as a foreign key in every other table affected then retain that foreign key. Otherwise retain the request. It will be needed to re-delete on restore. Without it you can't do as he asked so if you deleted it it you were doing it wrong.
"As for the right to be forgotten, well, IANAL but wasn't all this discussed at length some weeks or months ago?"
Weeks and months ago. And still we have numpties crawling out of the woodwork asking about which law trumps which when storage is legally mandated.
"Maybe come down from the tower occasionally and meet the real world of personal data scattered in Excel spreadsheets, Word documents, pdfs and for all I know coded into C# objects."
If this is the primary data storage then they have other problems already. If this is secondary storage - look for it particularly in Sales and Marketing or possibly HR - it needs to be dealt with. Audit the business and delete any of it you find. Permanently. Even if it means going through old file system backups (not the same problem as RDBMS as regards data integrity). In the real world it's this sort of secondary storage in the hands of users that's most likely to cause damage.
"You have Fred's data on a tape backup that you know you cannot dump in the bin but at the same time you can no longer read."
This raises questions about the sanity of the audit or about your failure to migrate the old data to new media once the old one becomes obsolete. It also raises the question of whether you have effectively forgotten everything on the old media already.
"Erase-on-restore is probably a nonstarter because it is technically trivial to *not* erase-on-restore"
It's equally technically trivial to not act on the request in the first place. No difference.
"If you delete the tokenisation key or the master record, the record in the backup becomes (to some extent) anonymous."
How do you handle the restoration of the backup of the key?
My only question is, once you've "forgotten" about somebody, how do you remember to forget them on a restore?
GDPR allows you to keep PII which is being held for a good reason. You couldn't, for instance, forget the delivery details of an order which is yet to be despatched. On this basis one should be able to hold the forget request until all the backups that the real data may be on have been superseded and wiped.
"As it says at the bottom of the article, Matt is head of ecosystem at Adobe. He left Mongo DB in 2014."
But still pushing cloud, e.g. "a developer's first decision is what cloud platform they'll use". My first decision would be "Does it matter if my data ends up on haveibeenpwned?" and take choice of storage place from there.
Despite these comments, ICANN’s general counsel John Jeffrey said that the ruling “did not provide the clarity that ICANN was seeking when it initiated the injunction proceedings”.
I'd say it provides excellent clarity. It shows that European registrars know what they're doing, know that some of the ICANN contract terms, being unenforceable in the EU, should be ignored and the business should proceed along legal lines. The sensible thing for Jeffrey to do would be to go back to his clients and tell them to let those registrars continue doing what the law says they should do.
But wow. That must have been one of the shortest times on record for a European court to give a US corporation a flea in its ear.
"I wonder if I can take Laithwaites Wine to task for sending me wine offers after I've told them several times I am no longer interested?"
After a long while Everest seem to have started sending letterbox litter to me - or at least having the Royal Mail deliver them to all local addresses. I'm considering ringing them to send a representative along - who will then be presented with the unwanted mail I wish to return. This, if organised nationwide, would be an effective deterrent as they wouldn't be able to distinguish real leads from complaints.
"Some admirers of technology have no idea how the ordinary selfish human world works."
Well, this one does because he spent about 14 years helping investigate crime, much of it terrorist related because we had a little local problem largely funded by the US. And emerged from that with a strong belief in the presumption of innocence and due process of law, fundamental concepts for a free society which surveillance tends to trample on rather severely.
"At this point, trying to argue that collecting the data is necessary falls flat on its face over the kerbstone of historic indifference to its accuracy and I'm fairly sure that german courts will point that out."
Sort of. The defendants might well point it out to the courts and the court would then note it in the judgement. Most likely the defence will point out that contract terms can't override legislation and here's a sling in which the court can hand ICANN its arse.
Probably not. The EU regulators didn't think so either so that's why they came up with a law. What's more it's a law based on a few decades of past experience in trying to regulate this area.
One of the side issues in a former job was that we provided a few silent alarms. Not entirely silent as they broadcast a message on the police network. They were used in one-off situations where there was reason to expect a ...umm.... situation. One was a bank that was subject to armed robberies. I'm told the police got so slick about that one that armed robbers were met outside the bank and ushered straight into the police car without passers-by realising what was happening. More reliably I was told that at one time there were 4 lots of would-be robbers all awaiting trial.
The police weren't always so slick. Another one was in a filling station which was repeatedly burgled. The police must have been told to go there on the alarm but not why. They rolled up, watched the burglars loading up their car and did nothing.
"Enhanced error reporting, including the memory state of the device when program crash occurs (which may unintentionally contain parts of a file you were using when the problem occurred)"
Translation: unintentionally = inevitably
Biting the hand that feeds IT © 1998–2019