6 ms·

This is the real news. It should be illegal to call something deleted when it is not.

JKCalhoun 1y ago
"Marked" for deletion.
Aeolun 1y ago
Or maybe it should be illegal to have a court order that the privacy of millions of people should be infringed? I’m with OpenAI on this one, regardless of their less than pure reasons. You don’t get to wiretap all of the US population, and that’s essentially what they are doing here.
- amanaplanacanal 1y ago
  They are preserving evidence in a lawsuit. If you are concerned, you can try petitioning the court to keep your data private. I don't know how that would go.
  - djrj477dhsnv 1y ago
    The privacy of millions of people should take precedence over ease of evidence collection for a lawsuit.
  - Aeolun 1y ago
    You can use that same argument for wiretapping the US, because surely someone did something wrong. So we should just collect evidence on everyone on the off chance we need it.
    - baobun 1y ago
      That's already the case. Ever looked into the Snowden leaks?
girvo 1y ago
> It should be illegal to call something deleted when it is not. I don't disagree, but that ship sailed at least 15+ years ago. Soft delete is the name of the game basically everywhere...
- eurekin 1y ago
  At work we dutifully delete all data on a GDPR request
  - sahila 1y ago
    How do you manage deleting data from backups? Do you know not take backups?
    - alisonatwork 1y ago
      Backups can have a fixed retention period.
      - sahila 1y ago
        Sure, but now when the backup is restored two weeks later, is the user redeleted or just forgotten about?
        alisonatwork 1y ago
        Depends on the processes in place at the company. Presumably if a backup is restored, some kind of replay has to happen after that, otherwise all the other users are going to lose data that arrived in the interim. A catastrophic failure where both two weeks of user data and all the related events get irretrievably blackholed could still happen, sure, but any company where that is a regular occurrence likely has much bigger problems than complying with GDPR. The point is that none of these problems are insurmountable - they are all processes and practices that have been in place since long before GDPR and long before I started in this industry 25+ years ago. Even if deletion is only eventually consistent, even if a few pieces of data slip through the cracks, it is not hard to have policies in place that at least provide a best effort at upholding users' privacy and complying with the regulations. Organizations who choose not to bother, claiming that it's all too difficult, or that because deletion cannot be done 100% perfectly it should not even be attempted at all, are making weak excuses. The cynical take would be that they are just covering for the fact that they really do not respect their users' privacy and simply do not want to give up even the slightest chance of extracting value from that data they illegally and immorally choose to retain.
jandrewrogers 1y ago
The concept of “deleted” is not black and white, it is a continuum (though I agree that this is a very soft delete). As a technical matter, it is surprisingly difficult and expensive to unrecoverably delete something with high assurance. Most deletes in real systems are much softer than people assume because it dramatically improves performance, scalability, and cost. There have been many attempts to build e.g. databases that support deterministic hard deletes. Unfortunately, that feature is sufficiently ruinous to efficient software architecture that performance is extremely poor such that no one uses them.

"Marked" for deletion.

Or maybe it should be illegal to have a court order that the privacy of millions of people should be infringed? I’m with OpenAI on this one, regardless of their less than pure reasons. You don’t get to wiretap all of the US population, and that’s essentially what they are doing here.

amanaplanacanal 1y ago
They are preserving evidence in a lawsuit. If you are concerned, you can try petitioning the court to keep your data private. I don't know how that would go.
- djrj477dhsnv 1y ago
  The privacy of millions of people should take precedence over ease of evidence collection for a lawsuit.
- Aeolun 1y ago
  You can use that same argument for wiretapping the US, because surely someone did something wrong. So we should just collect evidence on everyone on the off chance we need it.
  - baobun 1y ago
    That's already the case. Ever looked into the Snowden leaks?

girvo 1y ago

> It should be illegal to call something deleted when it is not. I don't disagree, but that ship sailed at least 15+ years ago. Soft delete is the name of the game basically everywhere...

eurekin 1y ago
At work we dutifully delete all data on a GDPR request
- sahila 1y ago
  How do you manage deleting data from backups? Do you know not take backups?
  - alisonatwork 1y ago
    Backups can have a fixed retention period.
    - sahila 1y ago
      Sure, but now when the backup is restored two weeks later, is the user redeleted or just forgotten about?
      - alisonatwork 1y ago
        Depends on the processes in place at the company. Presumably if a backup is restored, some kind of replay has to happen after that, otherwise all the other users are going to lose data that arrived in the interim. A catastrophic failure where both two weeks of user data and all the related events get irretrievably blackholed could still happen, sure, but any company where that is a regular occurrence likely has much bigger problems than complying with GDPR. The point is that none of these problems are insurmountable - they are all processes and practices that have been in place since long before GDPR and long before I started in this industry 25+ years ago. Even if deletion is only eventually consistent, even if a few pieces of data slip through the cracks, it is not hard to have policies in place that at least provide a best effort at upholding users' privacy and complying with the regulations. Organizations who choose not to bother, claiming that it's all too difficult, or that because deletion cannot be done 100% perfectly it should not even be attempted at all, are making weak excuses. The cynical take would be that they are just covering for the fact that they really do not respect their users' privacy and simply do not want to give up even the slightest chance of extracting value from that data they illegally and immorally choose to retain.

jandrewrogers 1y ago

The concept of “deleted” is not black and white, it is a continuum (though I agree that this is a very soft delete). As a technical matter, it is surprisingly difficult and expensive to unrecoverably delete something with high assurance. Most deletes in real systems are much softer than people assume because it dramatically improves performance, scalability, and cost. There have been many attempts to build e.g. databases that support deterministic hard deletes. Unfortunately, that feature is sufficiently ruinous to efficient software architecture that performance is extremely poor such that no one uses them.