Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you live in the EU, Google are legally obligated to hand over your data under GDPR notice.


If they have it. They can delete your data.


An interesting perspective, but GDPR also requires them to delete data according to policy. If, by their policies, the data should still be held, then you have the right to access it. If they deleted it contrary to policy, that would itself be a breach of GDPR, and you would likely have strong grounds to sue and seek relief. If the data was to be held pending court action and they deleted it, that could get even more serious for them, and into the contempt-of-court territory.


I don't think that's correct. The GDPR retention policy sets out maximum retention time.

The guiding principle is that data should only be retained as long as is required to serve the purposes for which it was collected. So if your account is permanently terminated, there is probably an argument that GDPR requires the deletion of all data as soon as possible.


GDPR sets out a maximum retention time as you point out, but it also regards the act of "erasure or destruction" as a processing operation (Art 4(2)).

Recital 83 highlights the importance of preventing "accidental or unlawful destruction, loss, alteration" of data, and Art 5(1) says "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)"

I wouldn't want to be in Google's shoes in such a situation, as the principle of fairness and transparency would come to light, and I think it would be quite hard for them to argue against this.

You are also right that GDPR sets out principles of not retaining data for longer than is required (data protection by default), although all of these rights have to be balanced. If you could argue the deletion was not lawful, fair, or transparent, you would have a breach under Art 5(1).

The Art 20 right to portability would also be relevant here, around people's right to port a copy of their own data. Given the existence of these rights, a blanket "we nuked all your stuff" would deprive a person of reasonably exercising their rights, and I could envisage consequences for this.

It would be really interesting to see some of this get put to the test though - GDPR could become a way to force "human intervention" in some of these situations on the basis of not wanting exposure to unwanted legal risk.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: