Backups and the right to be forgotten in the GDPR: An uneasy relationship. Issue 6 (December 2018)

• Record Type: Journal Article
• Authors: Politou, Eugenia; Michota, Alexandra; Alepis, Efthimios; Pocs, Matthias; Patsakis, Constantinos
• Is Part Of: Computer law & security review. Volume 34:Issue 6(2018)
• Page Start: 1247
• Page End: 1257
• Publication Date: 2018-12
• Subjects: GDPR -- Backup -- Right to be Forgotten; Computers -- Law and legislation -- Periodicals; Computer security -- Law and legislation -- Periodicals; Electronic commerce -- Law and legislation -- Periodicals; Data protection -- Law and legislation -- Periodicals; Computer security -- Law and legislation; Computers -- Law and legislation; Data protection -- Law and legislation; Electronic commerce -- Law and legislation; Periodicals; 343.0999
• DOI: 10.1016/j.clsr.2018.08.006
• Languages: English
• ISSNs: 2212-473X

Abstract

Abstract: The recent enforcement of the GDPR has put extra burdens to data controllers operating within the EU. Beyond other challenges, the exercise of the Right to be Forgotten by individuals who request erasure of their personal information has also become a thorny issue when applied to backups and archives. In this paper, we discuss the GDPR forgetting requirements in respect with their impact on the backup and archiving procedures stipulated by the modern security standards. We specifically examine the implications of erasure requests on current IT backup systems and we highlight a number of envisaged organizational, business and technical challenges pertained to the widely known backup standards, data retention policies, backup mediums, search services, and ERP systems.