GDPR 艺术。 17 GDPR 擦除权和使用实体私钥的字段级加密/解密

Question

长话短说……GDPR 被遗忘权可以通过两种方式实现：

选项 A：每个数据消费者/生产者负责 PII 数据删除。 删除是通过手动遍历生态系统中的所有参与者或在事件中传递来触发的。 当数据被删除时，每个数据消费者/生产者都会报告删除操作的状态，因此可以提交/报告/等“删除”事务。

选项 B：数据在摄取时加密，在消费时解密。 数据在摄取时根据业务实体密钥进行加密。 因此，当业务实体密钥被删除时，数据会被“删除”。 需要明确的是，它不是 rest 数据加密的一部分，其中整个数据存储在存储级别进行加密。

选项 A 的优缺点：

优点：

 1. No performance impact on tx basis.
 2. No hard requirements for data consumers or producers encrypting or  decrypting data on ingestion or consumption.
 3. No read auditing is required upon data retrieval. 
 4. Each data producer/consumer can run their own entity resolution/customer duplication and upon deletion request delete not single but multiple (duplicate) records.
 5. Easy to main PII data dictionary per data consumer/producer. Using [Jasypt][1] (http://www.jasypt.org/hibernate.html) and hibernate mapping domain model can be annotated transparently without effecting too much domain model itself. I would exclude where data fields limited in length (for example in rational databases) would required schema refactoring.

缺点：

 1. Each data producer/consumer should be aware of PII data and have tools to delete data upon request. 
 2. Additional integration to "master GDRP orchestrator" if such by committing/marking deletion
    transaction back. 
 3. Less/limited visibility and accuracy on potentially duplicated data as data scope is limited to a single dataproducer/consumer.

选项 B 的优缺点：

优点：

 1. Transparent data deletion without interacting with data producer/consumer upon deletion request.
 2. Scope of data marked for deletion is limited to encrypted data which means if your data gets ingested in encrypted form using business entity encryption key, data in backups, BI and etc gets encrypted automatically. 

缺点：

 1. Performance impact as your data consumer/producer will be pooling encryption keys per business entity upon ingestion and consumption. Multiple in the same transaction most likely specially for 'search' like operations. Some sources claims that performance degradation is 3% using transparent data encryption with a static encryption key. In here we're talking about multiple calls to key vault per business entity.
 2. Costly to main in case of HSM (Hardware based key vault).
 3. Single point of failure/ha/availability/replication in generation which is a key vault.
 4. Single point of lock for a data general in case key vault is jeopardized.
 5. Field level encrypted data is no longer indexable.
 6. Advanced search capabilities like in Oracle (wild, lexer and etc) are not longer available as data encrypted at application level and cannot be decrypted at the db level. 
 7. Data should be encrypted even for simple search like operations. For example simple usecase: you want to persist a customer, but before doing so you may want to check if that customer already exist. So traditionally you will try to look for a customer by his first/last/dob against your store. In case your data is encrypted at field level using business entity keys you have no possibility to search for a customer at the db level. In this case you need to load all data by decrypting it in memory or replicate/populate into your search index (which gets problematic as well in case search index lifespan is longer than what GDPR demands) in order to allow simple customer search.

对于选项 B ，我有更多缺点，但会停在这里，并要求您对其中的每一个发表评论。 我觉得选项 A在现实中比选项 B更可行，选项 B 看起来像是 GDRP Art17 实施的圣杯。

感谢您的意见/建议。 也可以随意列出您的选项。