Hacker News Reader

Comment by that_guy_iain | Hacker News Reader

My understanding is the right to deletion doesn't so much affect things such as logs, internal training data, etc.

Also, since that's a web store and the data comes from customer orders they would have no right to deletion as that information becomes protected for other legal requirements.

View on HN

From a GDPR perspective, it also covers logs, internal training data etc. If a user requires to be deleted, you have to delete everything, there can be no trace of their existence.

There's a reason many of us across the ocean look at that part of the GDPR like someone decided you could put the feathers back in the pillowcase if you just made it illegal for the feathers to be outside the pillowcase.

GDPR, from what the legal trainings I've had, logs aren't covered if you apply the technical requirement and costs, etc.

This also depends on if the data was sensitive and your log usage/retention policy, i.e. you can't just say "it's logs" to be able to keep things - you need to show you're only using them as logs.

Addresses are sensitive information and whatever was happening sounds like multi-purpose-consent-necessary data processing and it was years old.

> If a user requires to be deleted, you have to delete everything, there can be no trace of their existence.

False. Transaction data must be kept for legal reasons and deletion requests do not apply to it.

Yep, that might be true for certain industries.

But logs don't count as the transactional data that needs to be kept for legal reasons.

That depends entirely on what they're logging and why.

There are always time limits that apply, which means you need to have a process to delete the relevant log entries (or the whole log) eventually.

Sure, like 7 years. https://business.gov.nl/regulation/keeping-business-records/

Are they based in a jurisdiction that has right to deletion laws?

Reply on news.ycombinator.com