european-union gdpr data-protection cryptography
GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?
<p>The introduction of the <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" rel="nofollow noreferrer">GDPR (General Data Protection Regulation) </a> in May 2018 for all businesses targeting EU citizens raises questions regarding the <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Art. 17 right to erasure</a>, also known as the right to be forgotten.</p>

<blockquote>
  <p>The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay</p>
</blockquote>

<p>I think it is reasonable to say that deleting all data (backup included) is not feasible without delay. What about backups that go beyond the <em>subject</em> realm (e.g. database backups, disk backups, ...)? </p>

<p>One idea to solve a part of the problem would be to <a href="https://en.wikipedia.org/wiki/Crypto-shredding" rel="nofollow noreferrer">crypto-shred</a> data. So when a <em>subject</em> asks to erase him/her <em>personal data</em>, we simply <strong>erase the encryption key</strong>. That would render all data unusable. However, data encrypted with what is considered a strong encryption method might not be strong anymore in a not-so-distant future (e.g. quantum computing, new algorithms, or a weakness found in the encryption mechanism).</p>

<p>So here are my questions:</p>

<ol>
<li>Is crypto-shredding considered a valid erasure method? </li>
<li>What storage mediums are affected by the so-called <strong>undue delay</strong>?</li>
</ol>

<p>In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop.
When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore.</p>

<p>In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit.</p>

<p>As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other.
The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.</p>

<p>The GDPR only requires data to be put "beyond use". You don't need to erase your backups every time someone wants their <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/" rel="nofollow noreferrer">data deleted</a>.</p>
