Hacker News Reader

Comment by mc32 | Hacker News Reader

I'll leave that up to your imagination. Additionally, imagine you have an email archive policy but occasionally you need to have some messages deleted, for compliance reasons, do they get deleted from all places they existed in google infrastructure? Are that henceforth irretrievable by google?

View on HN

Are there legitimate cases where compliance requires deleting materials? That sounds like compliance avoidance, not compliance itself.

Yes, HIPAA compliance strictly requires properly disposing of patient health information.

Google Apps even has specific services for companies needing HIPAA compliance: https://support.google.com/a/answer/3407054?hl=en

If the material includes sensitive personal information, privacy laws may require that the information be destroyed or "put beyond use" within a certain timeframe after the information is no longer necessary.

You might also, for example, have contractual obligations with another company to delete business confidential information after the end of the contract.

Many corps operate 'compliance smoothing' in which materials are proactively deleted. Where I worked all e-mails were purged after 90 days unless the user manually saved them elsewhere.

If your legal tells you the legal from another entity wants their correspondence deleted, for some valid reason, you are compelled to carry that out.

At least in the US this is completely false and under some circumstances illegal.

There are legal-bounding reasons where you have to completely scrub data [0] [1]

[0]: https://en.wikipedia.org/wiki/Right_to_be_forgotten

[1]: https://en.wikipedia.org/wiki/Commission_nationale_de_l%27in...

You should never assume this. If compliance and assurance that nobody can read your emails is important, you shouldn't be hosting them on Gmail.

Reply on news.ycombinator.com