GDPR: sorting the fact from the fiction
I haven&#x27;t really dug into it being in the USA, but from what I&#x27;ve heard the big takeaway for my clients might be: &quot;You can never again accept a European as a patient, and for your own protection you might need to dismiss any European patients you have.&quot; I&#x27;m not really worried about legitimate cases where someone wants their data removed, as that seems unlikely. I&#x27;m less sure about the risks of some enterprising young lawyer over there finding a way (or a possible way that would end up thrown out) to leverage it to extort money.<p>Read at its bluntest, as I understand it this law seems to basically ban backups, at least those retained for any significant amount of time. Have a customer&#x2F;patient database on a cycle of daily&#x2F;weekly&#x2F;monthly backups that get pruned as they get older? You need to be able to purge any individual who requests it from those backups. Have regulatory or contractual requirements on keeping records? Well, that&#x27;s what the courts are for, hope you like the attorneys you&#x27;re going to be paying. Heck, for medical practices I&#x27;ve heard of insurance companies doing clawbacks of payments <i>years</i> after the date of service - what does a practice do if it serves a European with temporary insurance, gets a request to purge that person&#x27;s data, then gets a request for clarification from an insurance company?<p>Perhaps this is a complete non-issue for US companies, but I&#x27;m not so certain of that that I&#x27;d be willing to just dismiss it out of hand and if it&#x27;s not dismissed then parts of it are pretty scary.