3 ms·

My approach for my startup is that if anyone sends me a Subject Access Letter that I thank them for being a customer, cancel their account, and delete their dat

My approach for my startup is that if anyone sends me a Subject Access Letter that I thank them for being a customer, cancel their account, and delete their data. I note this in the terms of service up front to be transparent and totally comply with GDPR. Sadly, I think this is the lowest cost approach to dealing with the law, and removes the ability of an insane customer from causing us millions in liability.

arghwhat 8y ago
I think you should ask a lawyer about this approach. I would very much consider this to be non-compliant, as this is a form of transparency evasion. If it isn't directly addressed, it might be covered by whether the data handed out should be the data available at the time of the request, in which case it would be prior to you having a chance to delete it.
arghwhat 8y ago
I did some quick searching, and my gut feeling would appear to be correct: It is not legal to delete user data in order to avoid fulfilling a subject access request. It is okay if data has been routinely modified or deleted, but it must not be a result of the access request. Quoting the Information Commisioner's Office: Q: We have received a request but need to amend the data before sending out the response. Should we send out the “old” version? A: It is our view that a subject access request relates to the data held at the time the request was received. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it would be reasonable for you to supply information you hold when you send out a response, even if this is different to that held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DP Bill, it is an offence to make any amendment with the intention of preventing its disclosure.

arghwhat 8y ago

I think you should ask a lawyer about this approach. I would very much consider this to be non-compliant, as this is a form of transparency evasion. If it isn't directly addressed, it might be covered by whether the data handed out should be the data available at the time of the request, in which case it would be prior to you having a chance to delete it.

arghwhat 8y ago

I did some quick searching, and my gut feeling would appear to be correct: It is not legal to delete user data in order to avoid fulfilling a subject access request. It is okay if data has been routinely modified or deleted, but it must not be a result of the access request. Quoting the Information Commisioner's Office: Q: We have received a request but need to amend the data before sending out the response. Should we send out the “old” version? A: It is our view that a subject access request relates to the data held at the time the request was received. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it would be reasonable for you to supply information you hold when you send out a response, even if this is different to that held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DP Bill, it is an offence to make any amendment with the intention of preventing its disclosure.