An event store only grows. What has been appended never changes, and projections, upcasters and the outbox from modules 4.4 to 4.6 are built on exactly that. Data protection law, however, knows a right to erasure (Article 17 GDPR) and a right of access (Article 15). The Kladde has to be able to do both technically: show on request what it knows about a person, and make it disappear on request, even from a system that forgets nothing.

As in lesson 4.8.3, this lesson teaches the technique, not legal advice. When erasure can be demanded, which exceptions apply, and whether a value that nobody can decrypt any more counts as erased in law is for the controller to judge, with legal advice. The technique makes sure that its decision is carried out completely and within a few minutes.

The first rule: no persons in events

The simplest erasure is the one that is not needed. The house rules of the Kladde have therefore said since module 4.3: Personal data does not go into events, at most as an id. QuoteSent carries the CustomerId, not the customer's name. If the customer is erased, her name disappears from the contacts, and the event points to an id for which nothing exists any more. It no longer gives anything away.

Go through the events of the Kladde with this in mind and one place turns up all the same:

C#
public sealed record DealOpened(Guid CustomerId, string Title, DateTimeOffset OpenedAt) : DealEvent;

The title is free text. “Network for the Lindenhof Clinic” is harmless. “Maintenance at the Kranich family's” or “Dana Kranich's clinic” names a person, and the team writes things like that because it is practical. A free text field in an event is therefore always suspect. There are two ways:

  1. Take the text out of the event. The title lives in an ordinary table of the sales module next to the stream, such as sales.DealDetails, joined by the deal id. The event then says only that a deal was opened. Erasing means: change the row. This is the simpler way, and it is right when the text plays no role in the history of the deal.
  2. Encrypt the text in the event, with a key that belongs to this one person alone. Erasing means: forget the key. This is crypto-shredding. It is the way when the value has to belong in the event, for example because projections need it when they are rebuilt or because the event goes out as a message to another system.