I've worked for several companies and let me tell you the truth:
* accounts are never deleted, period *
At most there's a column in the table which specifies whether the account is alive or not. That's it.
back
13 comments
> accounts are never deleted, period
Want to just add my voice to others who’ve already said this isn’t true.
I work at a company where the task to ensure that every last shred of a person’s data is deleted when they leave the service took a whole team more than a year to develop. It includes all backups and databases, and is complete shortly after 45 days have elapsed (which is in our T&C to ensure that users have enough time to migrate their data, or even reverse their decision).
I also worked for companies where this isn't true. Some projects to setup Data Science / AI Pipelines for a few large companies.
Not only they do delete everything upon request and it's effective after a given number of days ; but they also made sure we correctly updated a person's consent in the middle of a marketing campaign if they _withdrew_ it. They could occasionally get an additional text or email if they sent their withdrawal after they were drafted in the current batch, but that's about it. It was disclosed to the customer as well.
Some do care about this stuff.
I worked for a company that made games that were used by young children and so covered by COPA. They definitely took a lot of care to delete everything.
How are backups dealt with in this scenario?
The practice developed around the GDPR looks something like this: You keep a separate record of deleted accounts. If you ever need to use or restore from backups, you need to filter the import or other use against that list. You can only do data-integrity checks against the backups and not use it for any purpose, of course. You must notify your local data protection authority if there are any exceptions. Like, if you restored a backup but you can't guarantee that deleted accounts remains deleted.
In other words, you don't need to wipe backups but you can't use them without processes in place to ensure you comply with your customers' rights granted under the GDPR.
How does this line up with something like a data breach of a backup?
In this case, you would still leak the data you had on the user. In France, according to the CNIL's recommendation, you can keep users' data in backups but you have to notify in clear words them that their data is kept X years.
As a side note, the CNIL also clarified things the author have issues with, for instance "without undue delay" is set to 30 days. In the UK, I've read they backups for specific users must be deleted when technically possible. I'm not sure how that works in practice.
Backups are not even processed under the UK GDPR when people want data wiped!
Put another way do you see any backup service/software advertising the ability to wipe data from backups to conform with GDPR DSAR requests? Its virtually impossible with existing tech services and legislators, law enforcement and the like are covering this up!
You can create a special deleted user account, and that claims ownership of FK relations that would break things. But then a lot of relational datastores aimed at Big Data (tm, rights reserved, patent pending) don't do super well at updates.
GitHub does that for comments with the Ghost user [0] for example
When a user requests deletion from my wishlist service, I fully delete everything, not only to be GDPR-compliant, but because it's the right thing to do. This includes:
- Their account changes and passports
- Their own wishlists, including all items added
- Any claims they've made on other wishlists
- Any item suggestions they've added to other wishlists
- The checked status of any item suggestions they've checked on other wishlists
- Removing them as partners on collaborative wishlists created by others
- The user
I'm not sure why someone would _want_ to keep user data around, as that seems more of a liability than an asset.
But that's the easy part. What about your backups?
Heroku keeps 7 days of automatic backups, and to the best of my knowledge they are deleted after this.
Ok, we all understand the idea of a tombstone (a "deleted" field in the record that is set on deletion). However, the article actually describes something much worse -- user deletes their account and subsequently the account is still active. Not "marked deleted but some data is still on the disk" but rather "completely active, works, can still log in". This is surprising to me. I would not expect to see that really ever. But the article claims that this occurred in some significant number of their tests. Not sure how to interpret that.
That's illegal under the GDPR and many other privacy laws and is subject to heavy fines if caught. I work in privacy at a large tech company, and we take this stuff extremely seriously.
The heavy fines everyone is fear-no getting about are a running joke now.
It took 4 years and a non-profit making lots of noise for a brazen, obvious and malicious GDPR breach to be investigated despite it being plastered on every single website out there (I’m talking about non-compliant consent popups).
To date, the accumulated fine amount over the 4 years and all fined companies is around a billion. Now lookup the profit that just one top adtech vendor makes in a year.
The spirit of the GDPR is great but its enforcement is severely lacking.
Yep. And you can extend that to all security compliance, not just GDPR. The biggest driver for compliance is being able to give solid answers on VSA questionnaires, not actually being secure. Certainly not fear of getting fined or failing an audit. The number of companies who get caught is so small, and the amount they get dinged for is so minuscule that it's not even a concern for them once they figure out how it works.
When the enforcing agency works against it, its harder to effect change. Do many companies change their ways due to GDPR though? Not having too many fines may also be a testament to compliance kicking in before fines are necessary.
I think the system improved the web as a whole for EU with new options for consumers despite.
How does the law relate to backups? What about reports run in the past and possibly saved on someone’s local drive?
At big tech companies I’ve seen and heard about, the answer is crypto shredding.
Encrypt all PII at rest with a per user data key.
GDPR deletion requests can then delete the data key.
This isn’t perfect, but it’s a step in the right direction IMO. Unfortunately I don’t see it being feasible for a typical company anytime soon.
Stlll keeps foreign keys and the key management can be a nightmare. Basically, you're talking per customer encryption keys... Even then, you still might get something if you have enough other data to cross-ref/compare against/you're just looking for something to confirm/parallel construct from.
Just linking to the root of the documentation itself doesn't help much. The relevant info appears to be Article 17, but even it makes no explicit mention of backups. There is this line, though; "[T]he controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data." This is not clarified in Article 23, Restrictions, so the logical meaning would be that even backups - assuming they are not read-only which would make this, at least in the minds of people who understand the technical limitation, unreasonable - must be purged of user data on an account deletion request. However, "reasonable to people who understand the technology" is not synonymous with "reasonable to people who make/enforce the law."
My previous employer had a "delete on restore" id list, if we ever needed to restore from a backup. My manager said that this should be sufficient for offline backups. They had a lawyer who had said it's OK but I of course don't have the full picture.
It is however a risk, too. The drives are encrypted, without power and not even networked but they can still be stolen together with the encryption key from the same building. But then probably you have bigger problems.
This also forces the systems that test the backups to be also offline, which is a huge hassle.
> Just linking to the root of the documentation itself doesn't help much.
I’m sorry, I didn’t have time to find a good specific reference, so I just linked to the whole document.
I suppose that a technical solution is to encrypt all backups of user data with one key per user. Then you only have to erase that user’s key if necessary.
No one really checks
Source : talked with people who implemented gdpr deletion at some companies.
So you're suggesting it's okay to ignore the law if the enforcement isn't complete? It's designed to protect people from corporate overreach.
Also, given that the EU has been taking increasing action against companies for non-compliance, I wouldn't bet on it remaining unchecked forever. In the intermediate term, I'd bet on there being third-party compliance checks and certificates, with companies that don't use such getting more attention.
It's not that enforcement is not complete, it's that enforcement is near non-existent. In that case, it makes sense not to spend disproportionate amounts of resources mitigating a very slim risk, especially if your competition is overtaking you because they don't have the burden of compliance.
Confluence even explicitly does this - you can do a “gdpr delete” which disables the user and replaces all info with random strings. It’s kind of hilarious.
I remember a service that I used 10 years ago that would do something like that. You would request to delete your account but it wouldn't work well as you stayed logged in; if you looked at your account panel most of your info was changed to random strings, including your email.
As long as all PII is purged in this process (tricky to guarantee with software like Confluence that is entirely dedicated to hosting user-generated data), that could be compliant.
Technically the foreign key relationships could themselves be considered identifying data.
How do you mean?
Let’s imagine you’re a modern bank and associate card transactions with the merchant.
Even if you sanitize/delete the account holder record, you can’t delete the transactions themselves (as it would screw up your accounting) nor the merchant association.
Now let’s say you have a very particular customer that always goes to a very specific restaurant at pretty much the same time every day consistently.
That pattern alone is enough to single out that particular person (and deanonymize them by correlating with other records such as cell phone location data, etc).
A bank would entirely be entitled to keep the info around. All information that must be retained by law (such as receipts, financial transactions etc.) is exempt from the GDPR and you cannot ask for deletion. You can ask that the holder of that information does not use it for purposes other than the ones covered by law, but that’s the full extend of it.
Ah yep, thought that was the case, thanks for clarifying :)
I wonder if they also go through all of their backups and purge the PII. I would be willing to bet, they don't.
Backups usually have limited retention after various data protection agencies. In my current location the recommended time is a few weeks for backups, a few days for logs etc. Those agencies are fully aware that nobody goes around purging data from backups (which may also be hard with airgapped backups etc.) and you might need to wait before being "forgotten".
Are they allowed to restore the account from backup if the user asks for the reopening of the account?
You only need to state to what extend and period the information is stored in backups, and have a process in place to purge it again in case of a restore.
I never realized that was the rule. I thought you had to go in and wipe the backups regularly.
Not required by the GDPR... so they will not.
This is a bit too absolute but I too have worked for SAAS companies who told people things were deleted when they were soft deleted or not deleted at all.
At the company I work for we actually hard-delete all user/tenant data, when requested. The column you mention is used for soft-deletion, which is a transient state. Even when not explicitly requested by the customer, we still hard-delete soft-deleted data that has been stale for at least X months (6?).
So yeah, some companies really delete customer data, by request or by policy.
Admittedly we're a two-person startup so not exactly the same as a big corporate, but at Supernotes[1] we actually delete you from the database when you delete your account.
Delete data first then delete accounts.
That's true. But * probably * pseudonymised :D
That was true until the GDPR made it not true.