My favorite in the bad old days was ETrade. They wanted money to delete your account - $80! Fortunately they had an 'ETrade checks' feature, so I wrote myself a check on my account for the entire total, directed their email to the trash and threw their snail-mail away for 2 years before it dried up.
Some discouraging anecdotes on how services handle account deletions
111–120 of 133 posts
Re: Some discouraging anecdotes on how services handle account deletions
#112Earlier quoted context omitted.
It's also considered heresy by HN, which doesn't remove comments of deleted accounts.
HN is surely different in that the comments are all public.
True, but the commenters are mostly anonymous now, and may be unmasked in the future when advanced de-anonymization techniques become available.
Hence it may be reasonable to request that all data be removed.
Re: Some discouraging anecdotes on how services handle account deletions
#113I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.
> accounts are never deleted, period Want to just add my voice to others who’ve already said this isn’t true. I work at a company where the task to ensure that every last shred of a person’s data is deleted when they leave the service took a whole team more than a year to develop. It includes all backups and databases, and is complete shortly after 45 days have elapsed (which is in our T&C to ensure that users have e…
I also worked for companies where this isn't true. Some projects to setup Data Science / AI Pipelines for a few large companies.
Not only they do delete everything upon request and it's effective after a given number of days ; but they also made sure we correctly updated a person's consent in the middle of a marketing campaign if they _withdrew_ it. They could occasionally get an additional text or email if they sent their withdrawal after they were drafted in the current batch, but that's about it. It was disclosed to the customer as well.
Some do care about this stuff.
Re: Some discouraging anecdotes on how services handle account deletions
#114Data once out is out. Period.
Try telling a friend a sufficiently spicy secret and then tell me there's a delete. It's just as much a falsehood as imagining you can un-break a window.
Re: Some discouraging anecdotes on how services handle account deletions
#115Earlier quoted context omitted.
The same principal about foreign key relationships could be applied to messaging apps, restaurant booking services or anything else where a user's relationships with other entities/users would allow them to be identified.
The posting I responded to was about a case where the transactions themselves cannot be deleted since they must be retained for accounting reasons, so the same reasoning applies here: If they need to retain the messages/bookings/... for legal/accounting reasons, then they're exempt. If they don't need to retain them, they can just delete them.
The banking example was a bit muddled because it mixed the necessity of deletion with the method of deletion.
Wherever possible a business should delete relational data upon request. However, relational data is special because it cannot be effectively deleted by overriding user data with random values as Confluence seems to do.
Even if banks were allowed to delete customer data, they would face the same problem as social or booking services in that their relational data must be truly 'removed' rather than just overridden.
Re: Some discouraging anecdotes on how services handle account deletions
#116I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.
This is a bit too absolute but I too have worked for SAAS companies who told people things were deleted when they were soft deleted or not deleted at all.
Re: Some discouraging anecdotes on how services handle account deletions
#117The post paints a discouraging picture overall, but it does have some interesting double standards if you consider these three separate quotes: > It would seem there is no end to how far businesses can take white-labeling and outsourcing. > I’m sure engineering time to manually delete data must be more expensive in the long run than creating processes and tools for customers and customer support representatives to ha…
No post body was provided.
Re: Some discouraging anecdotes on how services handle account deletions
#118Earlier quoted context omitted.
How does the law relate to backups? What about reports run in the past and possibly saved on someone’s local drive?
At big tech companies I’ve seen and heard about, the answer is crypto shredding. Encrypt all PII at rest with a per user data key. GDPR deletion requests can then delete the data key. This isn’t perfect, but it’s a step in the right direction IMO. Unfortunately I don’t see it being feasible for a typical company anytime soon.
Stlll keeps foreign keys and the key management can be a nightmare. Basically, you're talking per customer encryption keys... Even then, you still might get something if you have enough other data to cross-ref/compare against/you're just looking for something to confirm/parallel construct from.
Re: Some discouraging anecdotes on how services handle account deletions
#119Earlier quoted context omitted.
Name and shame. And please take the time to file a complaint.
Naming and shaming on a techie forum does nothing. People spent over a decade grousing about Micro$$$$oft on Slashdot to no effect. Regulators and legislators are the only people who can do something about this. If you want to make a difference, politick, vote, or lobby.
[deleted]
Re: Some discouraging anecdotes on how services handle account deletions
#120I wonder how this is supposed to work with workplace apps such as Slack, especially with regards to GDPR. Say I am leaving my job, and want my personal information to be purged from this 3rd party service (Slack). They say [1] "Primary Owners of a workspace or org must contact Slack to request deletion of a deactivated member's profile information." . What if I contact the "Primary Owner" before leaving my job and th…
If you are using company account, company owns the data. The data produced during company time is company's property. Company has to request for deletion. Slack is right about it.
This makes me ask more questions:
- Is my full name, birth date, telephone number, job and other details Slack collects company property?
- Can they also sell this to other 3rd parties along with my social security number which was also collected by the company during company time?
- Is Slack also free to sell this data to other parties afterwards?
- Does GDPR protect your personal information if you gave it away during your free / unemployed time using your personally owned devices and only to services you have admin access to?