[hedora]

> Example for 8b would be this: "We have technology in place which allows us with reasonable certainty to know whether or not you personal data has been disclosed"

Arguably, such technology doesn’t exist (at least when plugged into a computer network). What penalties are in place if you lie in the response?

[geofft]

I'd expect "with reasonable certainty" to mean something different to pedantic lawyers/regulators than to pedantic cryptographers. Although perhaps an actual lawyer might suggest another phrase there, like "industry-standard measures" or something.

[number6]

Yeah I think a lawyer would write something even more nebulous... We minimized the risk according with our assessment with industry standard measures in accordance with our threat model to a reasonable level of safety as defined in the international standards taking in account user experience and the requirements of our partners all in accordance with local and EU law...

[Silhouette]

Such technology can't exist, because it is fundamentally trying to prove a negative.

There are technologies you can use (with varying degrees of effectiveness) to reduce the risk of data leaking by monitoring or intercepting specific mechanisms through which leaks can occur, but you can never have reasonable certainty in this respect.

[insomniacity]

You can get most of the way there though: https://diogomonica.com/2017/10/08/crypto-anchors-exfiltrati...

[Silhouette]

Yes and no. That is the kind of measure that can help, but it's going to be very difficult to keep all relevant data within such a tightly controlled environment.

At some point you will probably need to work with the real data to do anything useful with it. There are situations where you really can operate on obfuscated/encrypted data, such as comparing password hashes, but these tend to be the exception rather than the rule.

And so, if you're compromised at a point with access to the raw data, or anywhere else from which access to such a point can be gained, you've still lost control of the data.

[number6]

I am not Sure what penalties there are for lying. I bet it's expensive ;)

And with lawyers and words I like to think of this quote:

"It depends on what the meaning of the word 'is' is. If the--if he--if 'is' means is and never has been, that is not--that is one thing. If it means there is none, that was a completely true statement....Now, if someone had asked me on that day, are you having any kind of sexual relations with Ms. Lewinsky, that is, asked me a question in the present tense, I would have said no. And it would have been completely true."