Enum Disposition 

#[non_exhaustive]
pub enum Disposition {
    Erase,
    Anonymise(&'static [&'static str]),
    Retain(&'static str),
    Unreachable(&'static str),
}

What erasure does to these rows.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Erase

The rows go. The ordinary case.

Anonymise(&'static [&'static str])

The rows stay and the person leaves them: the named columns are overwritten, everything else is untouched.

This exists because Erase breaks aggregates. A commission ledger cannot lose rows without the totals becoming wrong, and “your deletion made the accounts disagree” is not a story anybody wants. The columns named here must be nullable or have a default, which cratefield-module-privacy checks against the applied schema rather than trusting.

Retain(&'static str)

The rows stay, whole, and this says why in a sentence a regulator could read.

Retention is sometimes required — tax law outlives an account. Making it a variant that carries a reason means the argument is written next to the table it applies to, in a reviewed diff, rather than being the silence left by a table nobody declared.

Unreachable(&'static str)

The rows hold personal data and erasure cannot reach them, and this says why in a sentence a regulator could read.

This is a third thing, and the reason it exists is that the other two are both wrong for it: Erase and Anonymise name a subject column the query builder binds a request value to, and Retain says “the rows stay on purpose”, which reads as your data, kept deliberately — not as your data, kept because we have no way to find it. The case that demanded the variant is a table whose personal data is inside a value no equality predicate can match — a rendered message filed under the send, a composite <email>:<product> key — where declaring PersonalDataSet::none would make a subject-facing manifest report a table holding the person’s message as not personal data (issue #274).

Implementations

impl Disposition

pub const fn keeps_row(self) -> bool

Whether erasure leaves the row in place.

Unreachable is included: the row is not deleted, and anything reading this answer as “the data is gone” is being lied to exactly as hard as a Retain would lie. The difference is that a Retain row is counted, exported and described, while an Unreachable row can be none of those — which is the whole problem.

Trait Implementations

impl Clone for Disposition

fn clone(&self) -> Disposition

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Disposition

impl Debug for Disposition

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Disposition

impl PartialEq for Disposition

fn eq(&self, other: &Disposition) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Disposition