5

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is a need for a generalized view on the confusion regarding GDPR's "Right to be Forgotten".

A complex business user-centric web application might have references of user throughout and a complete hard delete (completely deleting the user from database) might create lots of havoc by breaking the referential integrity in the database and thereby in the entire application.

So, is soft deleting or pseudonymizing a user a correct approach meaning the user's record won't be removed from the database completely instead, his all personal information will be updated with a pseudonym (junk phrase) in the database. On UI/UX as well instead of all personally identifiable information, a pseudonym or a generic "Deleted User" or "User #234" (just as SO do) will show up. The general reference of the User's entry in database will not even be processed/used/displayed/transmitted/sold anywhere.

Please note that I am aware that GDPR is about how the data is processed and does not hold restrictions on the technicalities and designs one follows but the actual implementation and adaptions of the same are causing several severe technical constraints and the complete refactoring of the database architecture and references which happens to complicate the business application and might even need a complete restart/reset.

For instance, a Software Engineer would know that an Email can be used as identity and the entire app revolves around UserManager and the cookies. Moreover, many fields that are marked Required in database models on deletion may break the app completely.

So what should be the correct approach, in context of GDPR, when a user revokes his consent in a complex architectured web application?

Improve this question
3
  • 3
    If you can no longer identify the person from the data, is the data 'personal data'? From GDPR: 'Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’). An 'identifiable natural person' is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
    – Lag
    May 31, 2018 at 7:10
  • That is what is unsure: not deleting the records and pseudonyming them will make that data "no longer identifiable" or it will still be considered identified directly or indirectly
    – Karan Desai
    May 31, 2018 at 7:21
  • 1
    If you can't directly or indirectly identify people from the data, the data isn't personal data within the meaning of GDPR. The GDPR incentivises pseudonymisation and anonymisation.
    – Lag
    May 31, 2018 at 9:21

1 Answer 1

Reset to default
5
+50

Can you anonymise people

It is valid to anonymise the data of people, instead of deleting all of the records.

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Source

As long as the person is not identifiable, then you do not need to treat the data as personal under the GDPR.

You do have to inform a person once they are no longer identifiable, and be able to identify them if they provide the missing information:

If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.

Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.

Source

The articles covered by this are:

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .