I know that crypto shredding has it's own downsides (quantum computers??), but if data is only stored for a period of time (on the order of years), it seems reasonable to assume that crypto shredding keys that encrypt a specific user's data will make that data inaccessible. Does this still count as deletion though from a legal perspective?
My question is specific to CCPA, but I'm also curious about crypto shredding in relation to laws requiring data erasure in general.
An example of an implementation of crypto shredding might be: - Create a unique key pair for each customer using the strongest encryption available at the time. - Encrypt all customer data with these keys. - Customer data may then be combined into large archival files (on tape or CD backup), with each record of a customer's data being encrypted with their own specific keys. - A CCPA deletion request comes in, and we purge the key store of the decryption keys for that customer. - At this point we can no longer reasonably retrieve a customers data, even though it lives on archival media for a period of time. The only possible method of retrieval would be if decryption technology vast exceeded what we have available today.
I'm mainly looking for resources around the legal ramifications around this. My initial research shows that there are exceptions to archival storage of such data, but doesn't have anything regarding crypto shredding. My current assumption is that since this isn't theoretically permanent, it's not a valid way to delete data according to the law.