gdpr data-protection
Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?
<p>I referred this question: <a href="https://law.stackexchange.com/questions/26493/under-the-gdpr-should-transaction-data-be-deleted-on-account-deletion-or-on-use">Under the GDPR, should transaction data be deleted on account deletion or on user request?</a> which deals specifically with the use-case of e-commerce site. But still, there is a need for a generalized view on the confusion regarding GDPR's "Right to be Forgotten".</p>

<p>A complex business user-centric web application might have references of user throughout and a complete hard delete (completely deleting the user from database) might create lots of havoc by breaking the referential integrity in the database and thereby in the entire application.</p>

<p>So, is soft deleting or pseudonymizing a user a correct approach meaning the user's record won't be removed from the database completely instead, his all personal information will be updated with a pseudonym (junk phrase) in the database. On UI/UX as well instead of all personally identifiable information, a pseudonym or a generic "Deleted User" or "User #234" (just as SO do) will show up. The general reference of the User's entry in database will not even be processed/used/displayed/transmitted/sold anywhere.</p>

<p>Please note that I am aware that GDPR is about how the data is processed and does not hold restrictions on the technicalities and designs one follows but the actual implementation and adaptions of the same are causing several severe technical constraints and the complete refactoring of the database architecture and references which happens to complicate the business application and might even need a complete restart/reset.</p>

<p>For instance, a Software Engineer would know that an Email can be used as identity and the entire app revolves around <code>UserManager</code> and the cookies. Moreover, many fields that are marked <code>Required</code> in database models on deletion may break the app completely.</p>

<p>So what should be the correct approach, in context of GDPR, when a user revokes his consent in a complex architectured web application?</p>

<h1>Can you anonymise people</h1>
<p>It is valid to anonymise the data of people, instead of deleting all of the records.</p>
<blockquote>
<p>The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. <strong>The principles of data protection should therefore not apply to anonymous information</strong>, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.</p>
</blockquote>
<p><a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">Source</a></p>
<p>As long as the person is not identifiable, then you do not need to treat  the data as personal under the GDPR.</p>
<p>You do have to inform a person once they are no longer identifiable, and be able to identify them if they provide the missing information:</p>
<blockquote>
<p><strong>If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information</strong> in order to identify the data subject for the sole purpose of complying with this Regulation.</p>
<p>Where, in cases referred to in paragraph 1 of this Article, <strong>the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly</strong>, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.</p>
</blockquote>
<p><a href="https://gdpr-info.eu/art-11-gdpr/" rel="nofollow noreferrer">Source</a></p>
<p>The articles covered by this are:</p>
<ul>
<li>15 - <a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">Right of Access</a></li>
<li>16 - <a href="https://gdpr-info.eu/art-16-gdpr/" rel="nofollow noreferrer">Right to rectification</a></li>
<li>17 - <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Right to erasure</a></li>
<li>18 - <a href="https://gdpr-info.eu/art-18-gdpr/" rel="nofollow noreferrer">Right to restrict processing</a></li>
<li>19 - <a href="https://gdpr-info.eu/art-19-gdpr/" rel="nofollow noreferrer">Right to be informed</a></li>
<li>20 - <a href="https://gdpr-info.eu/art-20-gdpr/" rel="nofollow noreferrer">Right to data portability</a></li>
</ul>
