Hacker News Reader

Comment by nightfly | Hacker News Reader

My first thought when people bring up deleting things is backup tapes. Sure it might or might not be "deleted" from the live data set, but it's almost always gonna live on in backups for probably forever.

View on HN

GDPR affects backup tapes too

It does, but not like you'd think. If the backup is dormant, the right-to-be-forgotten portions can remain there. Once it comes out of cold storage, those RTBF requests have to be processed over the restored data. Although, in most cases, the dormant backups will expire and be deleted as per a data retention plan.

That does not seem to be entirely correct: https://blog.quantum.com/backup-administrators-the-1-advice-...

Which part isn't correct? What op described sounds like a good and easy way to do it (as long as you have sane retention periods) and doesn't seem to conflict with the article you linked in any way (in fact, they agree).

In addition you have to tell the customer how long you retain your backups (and only retain them for a reasonable time) and only restore for purely technical reasons.

This is usually solved by encrypting and throwing away the key or seed to effectively delete.

Tape is no excuse to violating data retention policies.

I agree. I find it hard to believe that anyone is going to transport all the physical tapes from cold storage and look through all the physical tapes.

My guess is that the data is removed on production and recovery sites. The data will be left on tape since they will most likely never see the light of day again.

This is usually solved by encrypting and throwing away the key or seed to effectively delete.

Doesn’t that just effectively delete it until it is common to have sufficient computing power to crack the encryption?

Reply on news.ycombinator.com