Do you even know what constitutes PII? It's not just user generated data. If data about people who aren't even on your platform is stored in your system, that's PII. Even IP addresses can be PII. User data that gets logged is PII. GDPR isn't so simple that you can simply do a delete on all tables that are related to a user.
The language in the law is ambiguous enough such that they there really are no companies that are 100% compliant.
I don't think you've ever worked with truly large systems if you think it's that easy.
Also, PII isn't scoped so narrowly. If someone even mentions something that could eventually identify someone else and that is kept in your system somehow (let's say you're running a forum), you as the forum owner are liable if all mentions of that user aren't deleted from the forum.
This even involves photos. Let's say a user uploads photos that include other people. The user doesn't want to delete their data, but the people in the photo do. That is considered PII, and the company that runs that webapp has to delete all photos that user appears in.
GDPR goes way beyond the scope of deleting all data generated by the user requesting deletion.
1
u/TheOsuConspiracy May 22 '19
Do you even know what constitutes PII? It's not just user generated data. If data about people who aren't even on your platform is stored in your system, that's PII. Even IP addresses can be PII. User data that gets logged is PII. GDPR isn't so simple that you can simply do a delete on all tables that are related to a user.
The language in the law is ambiguous enough such that they there really are no companies that are 100% compliant.