Backup Copy Revision for GDPR Compliance

Solution Overview

Problem

The General Data Protection Regulation (GDPR) does not specify how to handle backup copies of personal data that a person has the right to delete, leading to potential data loss and compliance issues, with existing restoration methods potentially reinstating deleted data, and current solutions being inefficient in ensuring complete deletion from backup copies.

Innovation Solution

A system that manages backup copies by creating revised backup copies by deleting data specified for deletion from a deletion request ledger, associating an updating time with these copies, and enabling restoration by removing data marked for deletion subsequent to this time, ensuring compliance with GDPR by efficiently removing personal data from backup copies during restoration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional backup/restore operations are performed without considering deletion requests, then data restoration capability is maintained, but GDPR compliance is violated due to reinstating deleted personal data

Engineering Contradiction:

ImproveGDPR complianceVSAvoiddata restoration capability

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The system performs preliminary actions by creating revised backup copies that proactively remove personal data specified in deletion requests before restoration operations occur. The backup management application identifies personal data in backup copies matching deletion requests and creates revised backup copies with this data removed, ensuring GDPR compliance is established in advance rather than reactively.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system segments the backup copy into two parts: data subject to deletion (personal data matching deletion requests) and data to be retained. By creating revised backup copies that separate and remove only the personal data portions while preserving other data, the system enables selective deletion that maintains restoration capability for non-personal data while achieving GDPR compliance.

Inventive Principle:

Principle #1Segmentation

2Reliability

If personal data is deleted from backup copies to ensure GDPR compliance, then compliance risk is reduced, but restoration completeness is compromised

Engineering Contradiction:

ImproveGDPR complianceVSAvoidrestoration efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary actions by creating revised backup copies that proactively remove personal data specified in deletion requests before restoration operations occur. The backup management application identifies personal data in backup copies matching deletion requests and creates revised backup copies with this data removed, ensuring GDPR compliance is established in advance rather than reactively.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary mechanism (revised backup copies) that mediates between the conflicting requirements of GDPR compliance and restoration completeness. These revised backup copies serve as intermediate artifacts that contain only the non-personal data portions, allowing restoration operations to proceed efficiently without requiring complex filtering or verification during the restoration process itself.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If deletion requests are processed during restoration operations, then compliance is achieved, but restoration time is significantly increased

Engineering Contradiction:

ImproveGDPR complianceVSAvoidrestoration time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by creating revised backup copies that proactively remove personal data specified in deletion requests before restoration operations occur. The backup management application identifies personal data in backup copies matching deletion requests and creates revised backup copies with this data removed, ensuring GDPR compliance is established in advance rather than reactively.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11599423B1Managing backup copies in a right-to-delete personal data environment

Publication Date: 2023.03.07 EMC IP HLDG CO LLC

AI summary

Managing backup copies in a right to delete personal data environment is described. A system creates a revised backup copy by deleting any data that a deletion request ledger specifies for deletion from a backup copy that was created for a data object. The system associates an updating time with the revised backup copy. The system retrieves the revised backup copy in response to receiving a restoration request corresponding to the revised backup copy. The system enables restoration of the data object by deleting any data i) that the deletion request ledger specifies for deletion from the revised backup copy and ii) that is associated with a deletion request time which is subsequent to the updating time.