Is it possible in Germany to file a GDPR violation against vendors who outright refuse deletion or fail to comply otherwise?
Some discouraging anecdotes on how services handle account deletions
61–70 of 133 posts
Re: Some discouraging anecdotes on how services handle account deletions
#62Earlier quoted context omitted.
How do you mean?
Let’s imagine you’re a modern bank and associate card transactions with the merchant. Even if you sanitize/delete the account holder record, you can’t delete the transactions themselves (as it would screw up your accounting) nor the merchant association. Now let’s say you have a very particular customer that always goes to a very specific restaurant at pretty much the same time every day consistently. That pattern al…
Is this based on your interpretation of GDPR, or legal precedent?
Re: Some discouraging anecdotes on how services handle account deletions
#63Earlier quoted context omitted.
I’d have to look at what Apple requires, but I think deleting comments is good (maybe replacing them with a slug). That’s considered heresy, though, by today’s “data is money” crowd. I have seen apps that delete an entire thread, when a root comment is deleted; including responses by other people. I think SMF did that. In the case of our app, we leave communication between users to other apps (like Mail and Messages)…
It's also considered heresy by HN, which doesn't remove comments of deleted accounts.
I think this crowd would not react well, to that. May also be technical limitations. Not so easy to do that.
Re: Some discouraging anecdotes on how services handle account deletions
#64> The last successful request was processed 71 days after the first email. The GDPR doesn’t define “without undue delay”, but I’m fairly certain that it requires companies to not stall for over 10 weeks.
Having worked at a couple of cloud companies... the GDPR deletion timeline within our systems was 90 days. I assume that legal had vetted that timeline.
Re: Some discouraging anecdotes on how services handle account deletions
#65The post paints a discouraging picture overall, but it does have some interesting double standards if you consider these three separate quotes:
> It would seem there is no end to how far businesses can take white-labeling and outsourcing.
> I’m sure engineering time to manually delete data must be more expensive in the long run than creating processes and tools for customers and customer support representatives to handle delectation requests.
> 11 of these were smaller niche online stores.
If I'm a "niche online store", am I somehow excused from these rules? I would think there would be a market for white-labeled online stores for niche online stores, but that's somehow Bad™? But having an in-house engineering team develop the platform and respond to development needs as they arise (to handle the first account deletion request) is also Bad™?
Re: Some discouraging anecdotes on how services handle account deletions
#66It is a function of incentives and punishments. The nature of the company you are in and the risk the org is willing to bear plays out. I work for one that puts in a lot of effort to get rid of all the user data if they request a deletion based on the laws of the country they are from which we can expand to any user as needed. Whenever we have found gaps in our existing data storage, we go back and really try to clean it up. However there is a lot of legacy that surfaces out time to time.
The reality is doing this is messy and is going to remain so for some time. One cannot suddenly start after years of no incentives in the online economy to do this and get to cover all areas without huge cost. This requires giving up competitive advantage today. Mid to small organisations that were beyond startup state but not yet having 1000's of engineers, which have to balance growth and operational aspects are left in the most difficult situation. As the laws started taking hold, their incentive structure is still not fully aligned with this as the digital economy does not yet reward them for this enough nor does enforcement create a large enough risk yet. Same thing plays out with some of the larger orgs, just that they have more lawyers to help them stall this as humans are always biased to keep the status quo if it is beneficial to them.
Personally I think we've had a start but its going to take some time to get to where we need to be. I really applaud the idea of the privacy laws and the intent behind them. Its just that one has to recognise we won't be getting to a state of good behaviour within a few years after a couple of decades of not having those requirements baked in from the get go. Old habits have to be replaced as well. The enforcement is hard and that will be something that has to be bubbled upwards from the ground up by users themselves to create a digital economy where consumers/users reward those that respect their privacy. It is just not yet that way today, so why would the organisations change? The risk is low as enforcement is hard and the user demand is not enough.
Most successful would be attempts by large organisations such as Apple and laws like GDPR which forces developers and companies to change their thinking. By asking for change and continuing to iterate on that you can start seeing a slow move towards development practices that will have privacy by default. You need the whole chain of actors to move towards this: The product managers, the engineering leads and architects, the decision makers, the risk assessors. Once enforcement is more steady alongside more demand from users the balance will come. All of this moves slowly whether we like it or not.
Re: Some discouraging anecdotes on how services handle account deletions
#67I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.
You can create a special deleted user account, and that claims ownership of FK relations that would break things. But then a lot of relational datastores aimed at Big Data (tm, rights reserved, patent pending) don't do super well at updates.
GitHub does that for comments with the Ghost user [0] for example
Re: Some discouraging anecdotes on how services handle account deletions
#68Earlier quoted context omitted.
As long as all PII is purged in this process (tricky to guarantee with software like Confluence that is entirely dedicated to hosting user-generated data), that could be compliant.
I wonder if they also go through all of their backups and purge the PII. I would be willing to bet, they don't.
You only need to state to what extend and period the information is stored in backups, and have a process in place to purge it again in case of a restore.
Re: Some discouraging anecdotes on how services handle account deletions
#69I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.
I worked for a company that made games that were used by young children and so covered by COPA. They definitely took a lot of care to delete everything.
How are backups dealt with in this scenario?
Re: Some discouraging anecdotes on how services handle account deletions
#70I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.
[deleted]