Hacker News Reader

Comment by webish | Hacker News Reader

Our current implementation is similar to this, bit if the sender deletes a message, don't the recipients have a right to retain a message that was sent to them? For their own records I mean. This is what's causing the difficulty. A sender's right to delete the message vs a recipient's right to keep copies of messages sent to them.

View on HN

>don't the recipients have a right to retain a message that was sent to them?

No. There is no "right to retention" in the GDPR. Users have the right to access any data you hold that relates to them (with some exceptions), but you are under no obligation to retain data. GDPR requires you to do the exact opposite - delete (or thoroughly anonymise) data as soon as possible.

Art.5(1)(e) says "Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". If you're aiming for maximum GDPR compliance, it would be sensible to delete the messages from your server as soon as they have been delivered to the recipients. You're a messaging service, not an archival service; storing the messaging data or metadata indefinitely is contrary to the principles of the GDPR and exposes you to liability if that data is ever leaked.

I'd also question why you need plaintext access to user messages in the first place. End-to-end encryption protects you and your users. If you can't access the data, you can't inadvertently breach the GDPR.

https://gdpr-info.eu/art-5-gdpr/

Would any of the people who downvoted my comment like to explain their point of disagreement? If you believe my statement to be factually wrong, it would be more useful to correct it rather than simply downvoting it.

You probably need plain-text access so that messages can live on the server rather than the device. It is a common desire for users to (1) use more than one device; (2) sign in a new device and have access to message history; (3) message search to work. You can probably put these together in an end-to-end encrypted system -- can apple access old messages on a new device? -- but it's very complex.

You might need to provide more context here.

Depending on whether it's targeting businesses or consumers, expectations and needs are different.

You really ought to talk to counsel. I founded a startup, and the thing I didn't know before I did that is lawyers will front you legal fees. A typical arrangement with a good valley law firm goes like this: they agree to front you $15-$20k in legal fees, payable immediately upon a raise exceeding $500k. They won't front you cash they have to pay out, ie you'll have to pay filing fees or other stuff, but the majority of your expenses will be legal time. This fee arrangement isn't necessarily available to any random, but if you can get a warm intro to a startup partner at a good law firm (Wilson Sonsini, Gunderson Dettmer, Cooley, etc) you may be able to get this arrangement. Of course, they're not necessarily going to hand it out to anyone who asks.

As for the GDPR: The GDPR applies to "personal data". A user's email is certainly personal data. But if someone says a person's name in an email, that is also personal data.

Your problem is you have to either cover everything under consent or use legitimate interests and weigh -- ie conduct a balancing test as (very hand-wavingly) specified by the GDPR -- the balance between a data subject requesting a deletion's right to privacy and the legitimate interests of the other message recipients in retaining messages. A privacy lawyer can help walk you through doing this. Your other alternative is, if you have a lead regulator, directly reaching out to them and asking for guidance. If you haven't, or can't, establish a lead regulator you may try the ICO. They've staffed up in an effort to be the one stop shop of choice, though the UK decided to leave the EU so who the hell knows what's going to happen. Alternatives include ie / DPC.

In particular, A17 specifies:

NB: A6.1.a is consent.

> (1) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

> a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

> b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

So your path seems somewhat straightforward: remove the link from the deletion requester to the message, and make sure your statement of purpose in the consent says that you will delete iff all recipients request deletion. This does mean you need to carefully write your GDPR consent forms for your service, but see lawyer bit above.

Reply on news.ycombinator.com