5

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right to be forgotten.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay

I think it is reasonable to say that deleting all data (backup included) is not feasible without delay. What about backups that go beyond the subject realm (e.g. database backups, disk backups, ...)?

One idea to solve a part of the problem would be to crypto-shred data. So when a subject asks to erase him/her personal data, we simply erase the encryption key. That would render all data unusable. However, data encrypted with what is considered a strong encryption method might not be strong anymore in a not-so-distant future (e.g. quantum computing, new algorithms, or a weakness found in the encryption mechanism).

So here are my questions:

  1. Is crypto-shredding considered a valid erasure method?
  2. What storage mediums are affected by the so-called undue delay?
  • What about the backups of the keys? – Paul Johnson Jan 22 at 22:33
3

In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop. When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore.

In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit.

As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other. The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.

  • Regarding the backup, it is often not feasible to delete data from an existing backup. But you can store all erasure request which were received after the backup was made. If it is ever required to restore that backup, you can reprocess all erase requests before any other processing. – wimh Jan 22 at 21:18
0

The GDPR only requires data to be put "beyond use". You don't need to erase your backups every time someone wants their data deleted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.