The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right to be forgotten.
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay
I think it is reasonable to say that deleting all data (backup included) is not feasible without delay. What about backups that go beyond the subject realm (e.g. database backups, disk backups, ...)?
One idea to solve a part of the problem would be to crypto-shred data. So when a subject asks to erase him/her personal data, we simply erase the encryption key. That would render all data unusable. However, data encrypted with what is considered a strong encryption method might not be strong anymore in a not-so-distant future (e.g. quantum computing, new algorithms, or a weakness found in the encryption mechanism).
So here are my questions:
- Is crypto-shredding considered a valid erasure method?
- What storage mediums are affected by the so-called undue delay?