7

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right to be forgotten.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay

I think it is reasonable to say that deleting all data (backup included) is not feasible without delay. What about backups that go beyond the subject realm (e.g. database backups, disk backups, ...)?

One idea to solve a part of the problem would be to crypto-shred data. So when a subject asks to erase him/her personal data, we simply erase the encryption key. That would render all data unusable. However, data encrypted with what is considered a strong encryption method might not be strong anymore in a not-so-distant future (e.g. quantum computing, new algorithms, or a weakness found in the encryption mechanism).

So here are my questions:

  1. Is crypto-shredding considered a valid erasure method?
  2. What storage mediums are affected by the so-called undue delay?
Improve this question
2
  • What about the backups of the keys?
    – Paul Johnson
    Jan 22, 2019 at 22:33
  • @PaulJohnson Keys in the crypto-shredding scenario would be treated like data in the unencrypted data scenario. The backups of the keys are equivalent to the backups of unencrypted data. If we come to the conclusion that waiting for the pre-deletion backups to routate out of the history constitutes undue delay, then one would have to erase the keys from backups, as one would erase the data in the other scenario.
    – user149408
    Jan 17, 2020 at 14:54

2 Answers 2

Reset to default
4

In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop. When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore.

In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit.

As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other. The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.

Improve this answer
1
  • 2
    Regarding the backup, it is often not feasible to delete data from an existing backup. But you can store all erasure request which were received after the backup was made. If it is ever required to restore that backup, you can reprocess all erase requests before any other processing.
    – wimh
    Jan 22, 2019 at 21:18
1

The GDPR only requires data to be put "beyond use". You don't need to erase your backups every time someone wants their data deleted.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .