It's perhaps worth discussing the possibility that append-only logs replicated to multiple places may be likely to make the mishandling and theft of private data more likely, rather than less.
The only real form of true immunity to private information theft is to have no private information. It's impossible to lose what you do not have. Everything else is layered controls and policies to detect, alarm, contain, deter, and otherwise enable you to deal with attacks as they come. That's what good defenses looks like for most companies - defense in depth.
In practice, it often looks like aggressive patching policies and administrative controls coupled with careful monitoring, limited access to production, and regular audits. Security is a whole-enterprise problem, rather than a purely technical one that can be entirely addressed by code fixes.
Append-only logs replicated to multiple places is probably illegal under the GDPR. People have the right to demand all data about them is deleted, e.g. once they are no longer Travelex customers.
An interesting question is would you rather your bank leaked some personal information about you, or would you rather they lost all your information, and therefore all of your money?
In this case, it means that an append-only data store with a fixed retention time might be a perfectly reasonable way to store certain kinds of records. This means that an append-only data store is not guaranteed to run up against deletion requirements in all cases.
In my opinion, this is particularly salient and worth being aware of when the conversation centers around a financial company, data storage, GDPR, and deletion requirements. It is possibly not always likely to be as simple as "use append-only" or "append-only likely to be illegal".
> financial services company, is probably obligated to retain records. GDPR defers to these obligations.
Gee - how long until the GDPR-o-crats demand a fine from a company (possibly the "right to be forgotten" thing), and the company then uses the defense that "we would have destroyed the information, except for some other EU regulation.. You figure your own way out of that logical puzzle!"
Obviously everyone would much prefer the former. GDPR is a very bad law for many reasons, but rendering many basic IT strategies for robustness "illegal" (maybe) is one of them.
Of course GDPR defenders tend to take a stance of, anything reasonable is actually not illegal under GDPR even if it might appear to be so at first. It really is a horribly vague and useless piece of law making. I really hope the UK scraps it after Brexit, though I don't hold out much hope.
The only real form of true immunity to private information theft is to have no private information. It's impossible to lose what you do not have. Everything else is layered controls and policies to detect, alarm, contain, deter, and otherwise enable you to deal with attacks as they come. That's what good defenses looks like for most companies - defense in depth.
In practice, it often looks like aggressive patching policies and administrative controls coupled with careful monitoring, limited access to production, and regular audits. Security is a whole-enterprise problem, rather than a purely technical one that can be entirely addressed by code fixes.