Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some discouraging anecdotes on how services handle account deletions

ctrl.blog

Post reply on HN
Print view View original

101–110 of 133 posts

Re: Some discouraging anecdotes on how services handle account deletions

#101

Post by Sayrus »

bluehatbrit wrote: post #94
d2wa wrote: post #91

Earlier quoted context omitted.

The practice developed around the GDPR looks something like this: You keep a separate record of deleted accounts. If you ever need to use or restore from backups, you need to filter the import or other use against that list. You can only do data-integrity checks against the backups and not use it for any purpose, of course. You must notify your local data protection authority if there are any exceptions. Like, if you…

How does this line up with something like a data breach of a backup?

In this case, you would still leak the data you had on the user. In France, according to the CNIL's recommendation, you can keep users' data in backups but you have to notify in clear words them that their data is kept X years.

As a side note, the CNIL also clarified things the author have issues with, for instance "without undue delay" is set to 30 days. In the UK, I've read they backups for specific users must be deleted when technically possible. I'm not sure how that works in practice.

Re: Some discouraging anecdotes on how services handle account deletions

#102

Post by danielskogly »

efdee wrote: post #87
danielskogly wrote: post #77

Earlier quoted context omitted.

When a user requests deletion from my wishlist service, I fully delete everything, not only to be GDPR-compliant, but because it's the right thing to do. This includes: - Their account changes and passports - Their own wishlists, including all items added - Any claims they've made on other wishlists - Any item suggestions they've added to other wishlists - The checked status of any item suggestions they've checked on…

But that's the easy part. What about your backups?

Heroku keeps 7 days of automatic backups, and to the best of my knowledge they are deleted after this.

Re: Some discouraging anecdotes on how services handle account deletions

#103

Post by null_object »

itvision wrote: post #6

I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.

> accounts are never deleted, period

Want to just add my voice to others who’ve already said this isn’t true.

I work at a company where the task to ensure that every last shred of a person’s data is deleted when they leave the service took a whole team more than a year to develop. It includes all backups and databases, and is complete shortly after 45 days have elapsed (which is in our T&C to ensure that users have enough time to migrate their data, or even reverse their decision).

Re: Some discouraging anecdotes on how services handle account deletions

#104

Post by Xylakant »

spacebanana7 wrote: post #98
Xylakant wrote: post #81

Earlier quoted context omitted.

A bank would entirely be entitled to keep the info around. All information that must be retained by law (such as receipts, financial transactions etc.) is exempt from the GDPR and you cannot ask for deletion. You can ask that the holder of that information does not use it for purposes other than the ones covered by law, but that’s the full extend of it.

The same principal about foreign key relationships could be applied to messaging apps, restaurant booking services or anything else where a user's relationships with other entities/users would allow them to be identified.

The posting I responded to was about a case where the transactions themselves cannot be deleted since they must be retained for accounting reasons, so the same reasoning applies here: If they need to retain the messages/bookings/... for legal/accounting reasons, then they're exempt. If they don't need to retain them, they can just delete them.

Re: Some discouraging anecdotes on how services handle account deletions

#105

Post by Terry_Roll »

itvision wrote: post #6

I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.

Delete data first then delete accounts.

Re: Some discouraging anecdotes on how services handle account deletions

#106

Post by Terry_Roll »

andrei_says_ wrote: post #69
alasdair_ wrote: post #54

Earlier quoted context omitted.

I worked for a company that made games that were used by young children and so covered by COPA. They definitely took a lot of care to delete everything.

How are backups dealt with in this scenario?

Backups are not even processed under the UK GDPR when people want data wiped!

Put another way do you see any backup service/software advertising the ability to wipe data from backups to conform with GDPR DSAR requests? Its virtually impossible with existing tech services and legislators, law enforcement and the like are covering this up!

Re: Some discouraging anecdotes on how services handle account deletions

#107

Post by teddyh »

endominus wrote: post #85
teddyh wrote: post #74

Earlier quoted context omitted.

https://gdpr-info.eu/

Just linking to the root of the documentation itself doesn't help much. The relevant info appears to be Article 17, but even it makes no explicit mention of backups. There is this line, though; "[T]he controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data su…

> Just linking to the root of the documentation itself doesn't help much.

I’m sorry, I didn’t have time to find a good specific reference, so I just linked to the whole document.

I suppose that a technical solution is to encrypt all backups of user data with one key per user. Then you only have to erase that user’s key if necessary.

Re: Some discouraging anecdotes on how services handle account deletions

#108

Post by nicoburns »

giraffe_lady wrote: post #32
ChrisMarshallNY wrote: post #26

Earlier quoted context omitted.

I’d have to look at what Apple requires, but I think deleting comments is good (maybe replacing them with a slug). That’s considered heresy, though, by today’s “data is money” crowd. I have seen apps that delete an entire thread, when a root comment is deleted; including responses by other people. I think SMF did that. In the case of our app, we leave communication between users to other apps (like Mail and Messages)…

It's also considered heresy by HN, which doesn't remove comments of deleted accounts.

HN is surely different in that the comments are all public.

Re: Some discouraging anecdotes on how services handle account deletions

#109

Post by xyst »

Had a similar terrible experience with crypto.com. After the MFA and stolen digital assets debacle earlier this year, decided to [hard/soft] delete my account with them. The company has a very complicated process for account deletions which involves having the account owner send a picture of themselves holding a sign. The picture must meet several criteria in order to be accepted.

https://help.crypto.com/en/articles/3640569-how-to-close-cry... (note: as of today the link to their selfie requirements is dead)

The entire process took 45 days to resolve because their e-mail support is fucking terrible.

Re: Some discouraging anecdotes on how services handle account deletions

#110

Post by tybit »

andrei_says_ wrote: post #71
organsnyder wrote: post #30

Earlier quoted context omitted.

That's illegal under the GDPR and many other privacy laws and is subject to heavy fines if caught. I work in privacy at a large tech company, and we take this stuff extremely seriously.

How does the law relate to backups? What about reports run in the past and possibly saved on someone’s local drive?

At big tech companies I’ve seen and heard about, the answer is crypto shredding. Encrypt all PII at rest with a per user data key. GDPR deletion requests can then delete the data key. This isn’t perfect, but it’s a step in the right direction IMO. Unfortunately I don’t see it being feasible for a typical company anytime soon.
Post reply on HN