Hacker News new | ask | show | jobs
by discoursism 3013 days ago
> How do you automate personal data discovery, especially for already existing data?

You attach an owner id to every record, and make sure all your systems can dump all information they store according to owner id. To the extent existing systems don't, you fix them.
1 comments
Radim 3012 days ago
Charming response :-) Entire industry dismissed in a single HN comment. Poof!

I'm not sure we understand "data discovery" to mean the same thing, but you reminded me of "How To Draw An Owl":

http://sethgodin.typepad.com/seths_blog/2014/01/how-to-draw-...

link
discoursism 3012 days ago
Hrm, did you expect me to design the output of an entire industry in an HN comment? I didn't say it was easy to do. But it is what must be done. My goal was not to provide code, but an outline, a very rough sketch, rough to the extent that it could fit in a pair of sentences. I guess in that sense the owl metaphor is accurate!

We've had two years to work on this. At my company, we've had entire teams spending significant fractions of their time over the last year prepping. As a result, we'll be ready when the switch flips.

link
Radim 3012 days ago
It's refreshing to see such responsible approach.

What you suggest is (as far as I understand you) orthogonal to automated data discovery / inventory mapping, though.

link
discoursism 3012 days ago
I agree we are not using the same definition of data discovery. In my use case, you know a priori which user provided the data, you just need to plumb the information through to all downstream systems. This seems sufficient for GDPR as I understand it. I had not read your entire comment and did not realize you were promoting a system to try to do something like this automatically. I did not realize the initial question was rhetorical.

FWIW I would be worried about relying on such a system! But based on the description it seems helpful. What does it do about derivative data that doesn't directly contain any PII?

link