Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instead of deleting account, NYT appends ‘1000’ to username and email address

twitter.com

Post reply on HN
Print view View original

71–80 of 167 posts

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#71

Post by akx »

nitrogen wrote: post #66
koheripbal wrote: post #58

Earlier quoted context omitted.

Regardless of the constraint on the key, the design fact remains that deleting a user record that might, for example, have associated transaction data (like subscription payments) is a little complex. You don't want to cascade that deletion to a record of credit card charges, but you also need to make sure that all queries respect that the user record might now be deleted - ie make it an outer-join. It's far more rob…

Do active/inactive fields comply with data privacy laws like those in California and the EU?

IANAL, but if you anonymize (not just pseudonymize) the PII from the user table (and others) I think so, yeah.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#72

Post by latch »

perl4ever wrote: post #70
DevX101 wrote: post #64

Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…

I used to work where (not a service for the general public) there was an "is deleted" flag for everything, but every now and then a client would insist that data be really deleted, and depending on who it was and how they asked, we might go and do it, which was a huge hassle and would cause no end of problems down the line. On the other hand, "is deleted" flags end up causing issues when you forget to put "where not…

You can use row level security so that forgetting the filter isn't an issue.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#73

Post by viklove »

gentleman11 wrote: post #49

It’s odious that it’s impossible to delete accounts except in rare circumstances. Ever try? All anybody does is temporarily disable them unless you go through an hour with their tech support. Dark pattern at best, holding on to your data forever to continue selling it at worst

You know HN doesn't let you delete your account, right? Even if you send them an email, apparently they're "too backed up" to handle account deletion requests.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#74

Post by asdfman123 »

inopinatus wrote: post #25

I’d bet (a small amount of) money they have no ability to delete accounts at all, and it goes all the way down to foreign key constraints introduced by a well-meaning but inexperienced developer that unnecessarily couple the accounts table to many other records.

> it goes all the way down to foreign key constraints introduced by a well-meaning but inexperienced developer that unnecessarily couple the accounts table to many other records.

You make it sound like developers doing things the wrong way is the exception instead of the norm.

Good developers don't, but every place I've worked at has a few chunks of the software by people who didn't know or care enough to do things the right way.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#75

Post by Nextgrid »

ornornor wrote: post #35

Netflix does that too. You can’t delete your account so they just append a string like “csr_morgan” in the domain so that your account is “deleted” (you can’t login anymore, because your email address technically doesn’t have an account anymore) and you can re-register with your email later if you wish. But I’d you use the altered email and the same password, everything is still there. Pretty sure this goes against G…

> Pretty sure this goes against GDPR but I was totally unsuccessful at getting my account deleted.

Did you report this to your local privacy regulator (the ICO in the UK for example)? Not saying they'll do anything (I guess the "4% of global turnover" fines aren't enough to motivate them) but at least there's a record of it, and if anything else, a proof of how useless the whole regulation is.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#76

Post by MaxBarraclough »

mschuster91 wrote: post #67
isoskeles wrote: post #59

Earlier quoted context omitted.

Wouldn't they also need to replace saved billing details, like address and full name, to anonymized garbage?

In Germany not; these are required by law (§147 AO, https://www.gesetze-im-internet.de/ao_1977/__147.html ) to be kept for ten years. The legal base for allowing this national rule in European law is Art. 6, 1c GDPR.

I think something similar happens in the UK. It's generally believed here that laws telling you to retain data take precedence over the GDPR telling you to delete it. (I am very much not a lawyer, as you can doubtless tell.)

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#77

Post by jkaplowitz »

mschuster91 wrote: post #67
isoskeles wrote: post #59

Earlier quoted context omitted.

Wouldn't they also need to replace saved billing details, like address and full name, to anonymized garbage?

In Germany not; these are required by law (§147 AO, https://www.gesetze-im-internet.de/ao_1977/__147.html ) to be kept for ten years. The legal base for allowing this national rule in European law is Art. 6, 1c GDPR.

But they'd need to get rid of it in the 11th year, right? And even before then, they'd need to delete some of the earliest records for someone who has subscribed for more than 10 years. Lots of compliance traps remain.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#78

Post by true_religion »

mesozoic wrote: post #69
DevX101 wrote: post #64

Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…

Pretty sure that breaches GDPR and maybe CCPA. Maybe they can get away with anonomyzing the data but that doesn't sound like what is being done.

Sure, but a local paper like the New York Times is hardly subject to the laws of the EU, so GDPR doesn’t apply.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#79

Post by clairity »

DevX101 wrote: post #64

Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…

the easier way, assuming neither is a primary key, is to convert the field values to UUIDs, which has the added advantage of anonymizing the data. that's disadvantageous if you want to prevent re-signups though, unless you take other measures.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#80

Post by chrisshroba »

DevX101 wrote: post #64

Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…

Doesn't doing soft deletes on user data breach GDPR laws regarding deletion of user data when requested?
Post reply on HN