Let\u2019s be honest, while the GDPR\u2019s right to be forgotten\/right to erasure are a big win on the side of personal privacy, from a business standpoint this is a huge pain in the rear. I know this because I help handle deletion requests for The SSL Store and its subsidiaries. I see it first-hand. And generally the folks requesting the deletion are less than polite. They\u2019re often disgruntled and generally threaten to be litigious.<\/p>\n\n\n\n
The point I\u2019m making is that despite what it does for personal privacy, these edicts are not business-friendly. And many companies and organizations are actively looking for better ways to comply with the rights afforded by the GDPR while minimizing the work that must be done on their end. <\/p>\n\n\n\n
So today we\u2019re going to look at the GDPR\u2019s right to erasure,\nwhether there could be an encryption solution and then we\u2019ll finish by\ndiscussing why that solution would likely be a bad idea. <\/p>\n\n\n\n
Let\u2019s hash it out.<\/p><\/span>\n\n\n\n Let\u2019s start out by defining what the GDPR says about the right to be forgotten\/the right to erasure<\/a> and what organizations must do to comply with it.<\/p>\n\n\n\n Let\u2019s start with the nomenclature, Article 17 of the GDPR<\/a>, which lays out the rights of the data subject, refers to it as the \u201cRight to Erasure (\u2018right to be forgotten\u2019).\u201d So the two are basically interchangeable.<\/p>\n\n\n\n Article 17, as well as some advice from Articles 12 & 23,\nplus recitals 55 & 56, outline the requirement for organizations to erase\ninformation at the behest of \u201cdata subjects.\u201d<\/p>\n\n\n\n 1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:<\/p><\/blockquote>\n\n\n\n Now, those grounds (and I\u2019ll summarize for the sake of brevity)\nare:<\/p>\n\n\n\n When a data subject appeals to your organization for erasure\nof their personal data on one of those grounds, and you don\u2019t have a superseding\nreason to keep it, not only are you obligated to delete it, but you\u2019re also\nobligated to notify any partners you may have shared it with to delete it, too.<\/p>\n\n\n\n Obviously, this is not a productive use of company time and\nwhat many data subjects don\u2019t realize is that deleting data from any website,\nlet alone from a multi-headed corporate hydra is not all that simple. Where is\nall the data stored? What databases have copies? Is there any of this data that\nwe are obligated legally or by industry standards to keep?<\/p>\n\n\n\n It\u2019s not as easy as just pulling up a profile and clicking \u201cdelete.\u201d\n<\/p>\n\n\n\n And unfortunately, not much has been done to define exactly\nhow an organization should go about an erasure. This is, in my opinion, one of\nthe greatest weaknesses of the GDPR. In its earnest attempt to have the GDPR be\nuniversally applicable the EU has failed to properly define certain aspects of\nits new regulation that really do require some specifics. <\/p>\n\n\n\n And that has led to some rather interesting ideas on how to\ndo it in the least disruptive way possible.<\/p>\n\n\n\n In an article of New Zealand\u2019s edition of CIO Magazine<\/a>, a group of lawyers discuss how the GDPR\u2019s right to erasure jives with the immutability of data recorded on a blockchain. <\/p>\n\n\n\n Now, I\u2019ll preface with this: blockchain is an incredibly\ninteresting technology that is far less useful than a lot of the marketing and\ncrypto bros out there want you to believe. It is not a panacea. It can\u2019t solve\nany business problem. And most of the people who mention it all the time couldn\u2019t\nexplain it to you in a concise way to save their lives. <\/p>\n\n\n\n That little outburst aside, Russell McVeagh (a prominent New Zealand-based law firm) lawyers Liz Blythe, Michael Taylor, Rachel O’Brien and Zoe Sims came up with a rather unique solution to the problem: how do you satisfy the GDPR\u2019s right to erasure requirement on a blockchain?<\/p>\n\n\n\n Their answer: encryption. <\/p>\n\n\n\n Could personal data stored on a blockchain be effectively ‘deleted’ by encrypting it and then destroying the private key<\/a> so it can never be read? There is currently no firmly established answer, but there are reasons to be hopeful that this would be an acceptable solution.<\/p><\/blockquote>\n\n\n\n The reasons they offer are that (a.) it would be ironic if\nGDPR thwarted the \u201cpromise of blockchain,\u201d (b.) as mentioned earlier the GDPR \u201cis\nvague as to when exactly personal data is \u201cerased,\u201d\u201d and (c.) \u201cthe concept of\nencryption is already recognised [sic] in the GDPR.\u201d<\/p>\n\n\n\n Now, in fairness they also offer three points of caution, centering around logistics, the patchwork of legal regulations in various jurisdictions and the threat of the future. <\/p>\n\n\n\n And I applaud the unorthodox thinking that led to such a unique approach.<\/p>\n\n\n\n But this is a bad idea.<\/p>\n\n\n\n If, as so many politicians in Western nations have called for, encryption that makes use of backdoors or key escrow is \u201cresponsible encryption<\/a>,\u201d encrypting something and then purposely deleting the key so it can never be decrypted would probably be \u201cirresponsible encryption.\u201d <\/p>\n\n\n\n Frankly, if you\u2019re looking for a purely one-way process the\nbetter answer might be to hash the data, but encrypting it is definitely not\nthe way to go.<\/p>\n\n\n\n And the reason for that is in their final \u201cnote of caution.\u201d<\/p>\n\n\n\n 3. In theory, any type of encryption can be broken given enough time, energy and processing power. What is considered secure today may not be secure in the future. Merely encrypted data is therefore at risk \u2013 and working out the nature and extent of that risk will be an important part of the discussion.<\/p><\/blockquote>\n\n\n\n That is 100% true, if a little bit understated. Most of our current cryptosystems will be under immediate threat from quantum computing<\/a> when it becomes viable in about a decade. RSA is already facing challenges from various exploits, it\u2019s already ill-advised to use it for key generation<\/a>, and it\u2019s really only a matter of time before we have to discard it entirely.<\/p>\n\n\n\nThe GDPR\u2019s Right to Erasure<\/h2>\n\n\n\n
Don\u2019t encrypt your data and throw away the key instead of deleting it<\/h2>\n\n\n\n
![\"Hashed](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg\")
<\/figure>\n","protected":false},"excerpt":{"rendered":"