6 ms·

Is it legal to refuse to delete a users account?

by robrenaud 10y ago

jbronn 10y ago
Yes. Unless they said otherwise in their TOS.
- deleted 10y ago
  [deleted]
- dominotw 10y ago
  thats what i assumed too. they outright told me that they won't delete my account. Instead they sent me bunch of these totally irrelevant emails to me( probably just made a false assumption due to the timing) "Thank you for reaching out and providing us with the opportunity to clarify. We welcome and accept employees with all political beliefs at Grubhub, no matter who they voted for in this or any election. We do not discriminate on the basis of someone's principles, or otherwise. The message was intended to advocate for inclusion and tolerance -- regardless of political affiliation -- during this time of transition for our country. Thank you, Grubhub"
- deleted 10y ago
  [deleted]
- kbart 10y ago
  Actually, it depends on a country. For example, EU laws override ToS.
  - JoshTriplett 10y ago
    Only for companies under EU jurisdiction.
    - kbart 10y ago
      Pretty much all bigger companies have subsidiaries in EU (Uber included), so they must obey EU laws too. I think it's only a matter of time when Uber will get sued for privacy violations.
    - deleted 10y ago
      [deleted]
deleted 10y ago
[deleted]
erelde 10y ago
I think in some countries companies/websites have to keep a trace of all accounts. So they don't really delete accounts, pretend they do and move them to another DB.
taejo 10y ago
Not in the EU.
curryhowardiso 10y ago
This is actually a great technical and legal question. And it depends a lot on the type of service you have, and which jurisdiction's law governs you and your service provider. On the one hand, we have the EU's "right to be forgotten" actions against Google, which seem to be gaining ground and are essentially bona fide in their protection of the consumer/society, in the sense that it might be a good idea for other jurisdictions to adopt it as well. But consider the EU (and worldwide) regulation of banking and transactional accounts. Particularly the prohibitions on money laundering and counter-terrorism funding (AML/CTF laws). You're not allowed to open and close a bunch of bank accounts, which means that you don't really have a "right to be forgotten" in this sense either. Nor, if you are not a "legit" user, should you be. From a technical standpoint, how do you detect the law abiding citizens that want to close (in the sense of permanently deleting records) their account(s) from the malfeasant actors that want to launder money or fund terrorism by holding many accounts over time in order to obfuscate their transaction patterns. It's an interesting question that the law -- and to a certain extent, the people -- have not yet got a good answer
- throwaway199128 10y ago
  Google retaliates though by putting the reasons for removal on "chillingeffects.org". Chilling indeed that a company has no respect for privacy.
- DanBC 10y ago
  RtbF is possibly not relevant here. More important would be the EU regulations on data protections. These say that companies must explain what data they're gathering and why they gather it; and that companies can only gather what they need; and only keep it for as long as they need; and that it must be accurate; and that customers have a right to see the data and to have corrections made. But even the EU has exemptions and complications around data that's used to prevent crime.
andygambles 10y ago
HMRC (UK Tax Office) requires us to keep transactional information for 6 years. Upon request we delete accounts but if they have transactional data this is still held in accordance with our legal requirements.
- toyg 10y ago
  Transactional data surely does not have to include full card and address details though. That would contradict EU directives on sensitive data and privacy.
  - andygambles 10y ago
    We do not keep any card data. We have to keep address details to prove we have charged VAT correctly.
smcl 10y ago
I'm seeing a few replies suggesting that it varies between EU/US etc ... but either way it sounds like a REALLY effective way to piss off those customers and guarantee they'll never come back and use your service in future (or share such "horror" stories with their friends and relatives). I don't get why those companies would go out of their way to make things difficult for themselves in the long run
- johansch 10y ago
  (Sorry, late.) These companies don't seem to tend to think long-term, at least not at this level. It's all about growth acceleration/hacking.

Is it legal to refuse to delete a users account?

jbronn 10y ago

Yes. Unless they said otherwise in their TOS.

deleted 10y ago
[deleted]
dominotw 10y ago
thats what i assumed too. they outright told me that they won't delete my account. Instead they sent me bunch of these totally irrelevant emails to me( probably just made a false assumption due to the timing) "Thank you for reaching out and providing us with the opportunity to clarify. We welcome and accept employees with all political beliefs at Grubhub, no matter who they voted for in this or any election. We do not discriminate on the basis of someone's principles, or otherwise. The message was intended to advocate for inclusion and tolerance -- regardless of political affiliation -- during this time of transition for our country. Thank you, Grubhub"
deleted 10y ago
[deleted]
kbart 10y ago
Actually, it depends on a country. For example, EU laws override ToS.
- JoshTriplett 10y ago
  Only for companies under EU jurisdiction.
  - kbart 10y ago
    Pretty much all bigger companies have subsidiaries in EU (Uber included), so they must obey EU laws too. I think it's only a matter of time when Uber will get sued for privacy violations.
  - deleted 10y ago
    [deleted]

deleted 10y ago

[deleted]

erelde 10y ago

I think in some countries companies/websites have to keep a trace of all accounts. So they don't really delete accounts, pretend they do and move them to another DB.

taejo 10y ago

Not in the EU.

curryhowardiso 10y ago

This is actually a great technical and legal question. And it depends a lot on the type of service you have, and which jurisdiction's law governs you and your service provider. On the one hand, we have the EU's "right to be forgotten" actions against Google, which seem to be gaining ground and are essentially bona fide in their protection of the consumer/society, in the sense that it might be a good idea for other jurisdictions to adopt it as well. But consider the EU (and worldwide) regulation of banking and transactional accounts. Particularly the prohibitions on money laundering and counter-terrorism funding (AML/CTF laws). You're not allowed to open and close a bunch of bank accounts, which means that you don't really have a "right to be forgotten" in this sense either. Nor, if you are not a "legit" user, should you be. From a technical standpoint, how do you detect the law abiding citizens that want to close (in the sense of permanently deleting records) their account(s) from the malfeasant actors that want to launder money or fund terrorism by holding many accounts over time in order to obfuscate their transaction patterns. It's an interesting question that the law -- and to a certain extent, the people -- have not yet got a good answer

throwaway199128 10y ago
Google retaliates though by putting the reasons for removal on "chillingeffects.org". Chilling indeed that a company has no respect for privacy.
DanBC 10y ago
RtbF is possibly not relevant here. More important would be the EU regulations on data protections. These say that companies must explain what data they're gathering and why they gather it; and that companies can only gather what they need; and only keep it for as long as they need; and that it must be accurate; and that customers have a right to see the data and to have corrections made. But even the EU has exemptions and complications around data that's used to prevent crime.

andygambles 10y ago

HMRC (UK Tax Office) requires us to keep transactional information for 6 years. Upon request we delete accounts but if they have transactional data this is still held in accordance with our legal requirements.

toyg 10y ago
Transactional data surely does not have to include full card and address details though. That would contradict EU directives on sensitive data and privacy.
- andygambles 10y ago
  We do not keep any card data. We have to keep address details to prove we have charged VAT correctly.

smcl 10y ago

I'm seeing a few replies suggesting that it varies between EU/US etc ... but either way it sounds like a REALLY effective way to piss off those customers and guarantee they'll never come back and use your service in future (or share such "horror" stories with their friends and relatives). I don't get why those companies would go out of their way to make things difficult for themselves in the long run

johansch 10y ago
(Sorry, late.) These companies don't seem to tend to think long-term, at least not at this level. It's all about growth acceleration/hacking.