I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to as "Forget me".

My assumption is that the functionality will have to consist of a mix of deletion of records and anonymization. Especially where there are transactional data that cannot be deleted or for that sake cannot be legally deleted.

Another assumption about the procedures is that the end-user will have to be notified in advance about the "Forget me" job with a date and time. It would be impossible to notify after the job has been done, because then you would need the information that has just been erased. Of course if the customer calls at the date given then customer service would have no records of this customer and would not be able to search by any information given.

Accountability?

In this respect what about all logs of work done? Emails sent would necessarily have the mail-to address stored. I believe there is a conflict of laws, you are legally bound to keep log of messages since it documents work done, but on the other hand you cannot know who this person is. You could anonymize the email address, but then again what about the content of the communication?

Backups?

Does the law also mean that backups will have to "Forget"? That would be very impractical with write-once or streaming type media. How about backups prior to 2018? Backups may legally have to be stored for 10 years, but some would want to store them even longer.