The General Data Protection Regulation and Tape: The Elephant in the Room is Ransomware
Industry leaders love to talk to other industry leaders when it comes to the General Data Protection Regulation (GDPR), but they should talk to their local authority instead.
How many times have I heard this catastrophic scenario that predicts the end for tape (again)? It’s Monday, and your manager asks you to delete someone’s personal data from your backup copies because the data protection officer received an email asking the company to follow the “right to be forgotten.” So, you grab a coffee and start figuring out where to find the data—but how can you delete a single file in a tape? You can’t. You’ll need to wipe the entire tape. Should you restore everything? Delete the personal information and backup the remaining data again? Sounds complex. Now imagine that this happens many times per day because of this new regulation—the GDPR. Kind of scary, right?
It seems like we’re living in a world where backup software doesn’t use catalogs to track what datais stored where—a world where you need NSA tools to just make a file inaccessible to the public or internal users.
But let’s imagine another scenario. It’s Sunday morning and you find that part of your systems have been encrypted by a ransomware attack. You decide to use your backups…until you discover the criminals encrypted your backups first. This actually happened to one of our customers (Read the full story here). Now imagine that you have replicated your backups over the weekend, so your DR copies are also encrypted. No plan B, no plan C. Last but not least, it’s June 2018, and you need to comply with the GDPR—and you just failed to protect someone’s personal data.
So, is tape compatible with the GDPR?
Of course, tape is the best solution to protect data against ransomware attacks. Not only because, as far as we know, there is no ransomware designed to mount virtual drives and access tape, but also because, unless the criminals have physical access to your media (don’t forget to encrypt your backups), it’s impossible to reach and encrypt offline media.
These days, most companies are using disk-based backup (often with deduplication) as their plan B if a problem arises. But tape can be your plan C, protecting your data against online viruses while still being compliant with the GDPR.
But what about the “right to be forgotten?”
Here is where industry leaders should contact their local authority. At least this is what we have done. We requested help from the French data protection authority (CNIL) to better understand if tape can be an issue or an advantage for GDPR compliance.
The answer is clear. You need to protect your data against ransomware, and it’s OK to keep data on a backup as long as you don’t process it again, you protect it through encryption, and you delete it once you don’t need it (when it expires). For more details, read this blog for the #1 advice to deal with the GDPR and the right of erasure.
There is no problem at all with using tape, and the catastrophic scenario described earlier doesn’t have to happen if you use tape as a secondary, offline copy. You don’t need to delete a specific file if someone asks for the right to be forgotten. It’s OK to inform the data subject (the EU citizen) that you have an encrypted copy on tape to protect his or her personal information against ransomware, and that you’ll expire and delete this data in a reasonable timeframe (you have one month to acknowledge a data subject request).
Many industry leaders want you to go tapeless, often just because they don’t have tape in their portfolio or because they want to sell an alternative (like the cloud). But tape has an important role to play in your journey to protect EU citizens’ personal information and protect your production data against ransomware. And the good news is most backup software vendors know how to handle tape. So, as long as you use tape as your last line of defense, following the 3-2-1 data protection rule, it should be easy to be compliant and safe with tape.
The time when everything was on tape is over. With our new Scalar® libraries and LTO-8 media, you can protect petabytes of data—all controlled via your favorite backup software GUI—without even having to move a single tape from the library.
(Provided by Quantum)
Alex von Hassler’s long term focus is the continued testing, learning, and deployment of modern IT solutions. During his years as a DataSpan team member, his responsibilities grew from managing Salesforce CRM to improving system security, creating marketing initiatives, as well as providing continued support to the highly motivated and experienced team in an ever-changing industry. As DataSpan evolves to provide the best-fitting IT solutions to its customers, Alex von Hassler continues to hone his skills in the world of web-based ERP systems, security, and best customer engagement practices. Empowering such a dynamic team with the right tools provides him with enormous gratification.
