Thanks for the response.

According to commissioner Reding one of the key provisions of the “right to be forgotten” is:

“If an individual no longer wants his personal data to be processed or stored by a data controller, and if there is no legitimate reason for keeping it, the data should be removed from their system.”

Wouldn’t this provision address my use case? Since evernote and netflix have no legitimate reason to keep my data, they should be forced to remove it.

Saqib

Thanks for your comment, Bill

For me the “right to be forgotten” is the basic right.

Last month I wanted to close “delete” my evernote account because of the security breach at evernote. But it turns out evernote does not let you delete your account. You can disable the account, but not delete. That means that evernote will store my account info for ever, and possibly the deleted notes in some archived manner.

Another example is Netflix. Even if you delete your account, it retains all your profile, preferences, payment details and any other associated information with your account forever. There is no way to get that deleted.

The “right to be forgotten” will help me in getting this situation remedied by forcing the service provider to delete my information once there is no longer a legitimate reason to keep it.

Saqib

Another complication will be the aggregation of data, one piece may have little value, but when added to other snippets it can become valuable information. The value of this will depend on varying factors. What is being painted is a infinitely variable set of parameters with which to base your risk. it may be possible to assign quantitative values to some data to take for example the worst case scenarios, however this will likely require that the most restrictive controls be applied which will stiffle the working practices and place substantial costs on developing systems. this might lead to outsourcing the service to the cloud, in itself a danger as this will provide an out of sight mentality

I think what could be useful here is definitive guidelines, for example the current documentation from the ICO on data protection leads so many people who are not infosec experts asking for real life examples, as they simple do not know if an email address is personal data, or if a list of 1000 is, and lots more examples. the guidance really needs to be more prescriptive

I totally agree with assertion that data/privacy protection is a token gesture in most cases and is box ticking (a la pci) and that breach notification does work (in the initial stage at least my experience would suggest, after that it diminishes unless a serious breach occurs, minor breaches are just bau)