Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PSA: HelloFresh doesn't delete data when asked, only changes the email address

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 54 posts

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#11

Post by cronix »

clankyclanker wrote: post #9

Right. For most (American) companies (I don’t know about GDPR-folks), “delete” means “hide from requesting user” not “remove data from internal system.” Data is (at least a big part of) their business and they don’t further that end by removing data. Of course it’s shitty, but it’s industry standard practice. It’s similar to the Facebook shadow profile you have when you don’t even have a Facebook account: you can ask…

Also, if they do delete it from "current db," they likely have years of backups. I find it difficult to believe someone like FB (or any other) would unarchive multiple terrabyte archives from storage, restore them (db, etc), delete the data, and rearchive them, for each daily/weekly/monthly/yearly backup my data is contained within.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#12

Post by cronix »

valbaca wrote: post #4
FrenchDevRemote wrote: post #2

you can't instantly delete user data because of safety/liability reasons

Article 17 of the GDPR would disagree. """ “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month. """

Does that include data contained in their x years of backups?

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#13

Post by nerdjon »

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money.

It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the exception). I would gladly add a couple days of transit time and pay a bit to catch the companies selling my information.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#14

Post by 0x0000000 »

nerdjon wrote: post #13

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the…

If you don't need to use the second line for "Street Address", you might be able to repurpose it and put in a unique identifier for each entity you conduct business with. Might depend on your mail carrier being OK with putting a letter to "Apt 41723" in the only mailbox at the primary address.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#15

Post by legitster »

One of the bizarre machinations that our legal team determined is that you should be able to delete your data and still be a customer. Which means retaining all sorts of billing information until you actually delete your account.

Did you try reaching out to HelloFresh about this? At our company all GDPR requests are manually serviced. You can likely get a human being to respond.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#17

Post by jgalt212 »

0x0000000 wrote: post #14
nerdjon wrote: post #13

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the…

If you don't need to use the second line for "Street Address", you might be able to repurpose it and put in a unique identifier for each entity you conduct business with. Might depend on your mail carrier being OK with putting a letter to "Apt 41723" in the only mailbox at the primary address.

Does the USPS Address Verification API reject such "modifications"?

https://www.usps.com/business/web-tools-apis/

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#18

Post by duxup »

clankyclanker wrote: post #9

Right. For most (American) companies (I don’t know about GDPR-folks), “delete” means “hide from requesting user” not “remove data from internal system.” Data is (at least a big part of) their business and they don’t further that end by removing data. Of course it’s shitty, but it’s industry standard practice. It’s similar to the Facebook shadow profile you have when you don’t even have a Facebook account: you can ask…

I don't doubt that's it but as also dev my first inclination is to soft delete most anything. Later do a real delete to avoid any mistakes.

Atlassian maybe could have used that ...

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#19

Post by yurishimo »

jgalt212 wrote: post #17
0x0000000 wrote: post #14

Earlier quoted context omitted.

If you don't need to use the second line for "Street Address", you might be able to repurpose it and put in a unique identifier for each entity you conduct business with. Might depend on your mail carrier being OK with putting a letter to "Apt 41723" in the only mailbox at the primary address.

Does the USPS Address Verification API reject such "modifications"? https://www.usps.com/business/web-tools-apis/

The OP linked the German version of hello fresh so likely moot.

Re: PSA: HelloFresh doesn't delete data when asked, only changes the email address

#20

Post by mrsuprawsm »

Sadly many companies do the same thing, violating the GDPR, even EU-based companies who know better.

I wonder if engineers who built and have knowledge of these systems could anonymously disclose/leak details of violations to a site pairing them with other engineers. The other engineers could submit a GDPR forget-me request, which the company wouldn't be able to fulfil, and then people could complain to the national regulators with specific instructions on how to find said not-actually-deleted information. Obviously it would violate non-disclosure agreements, but I'd imagine that would get companies to clean up their act fairly quickly, or at least it would if the national regulators had more teeth.

Post reply on HN