3 ms·

This is speculation, but I wonder if this is not the outcome of legal compliance efforts with respect to defined data retention periods in various pieces of con

This is speculation, but I wonder if this is not the outcome of legal compliance efforts with respect to defined data retention periods in various pieces of consumer privacy legislation over the last few years. From Recital 39 of the GDPR: "This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review." In the context of F500, I've seen compliance efforts around this that have mandated deletion in the case of inactivity for consumer applications that most people would have reasonably assumed would have been kept around even if they didn't log in. This is hinted at in the article "...to better align with common practices across the industry, the company said on Wednesday." And if we're going to take a cynical view, wouldn't it be that Google would never delete user data (the source of their revenue) unless they absolutely had to?

tehabe 6y ago
This doesn't really apply here, this is about data which is stored by the users on the services for being stored on those services according to the ToS of Google. So, it the purpose is only expired when a user decides to delete the data.
- joshuakelly 6y ago
  In general, the consumer data privacy laws in regions where Google has significant regulatory exposure do not permit indefinite data retention of PII. My speculation is that Google sees an across the board, 2-year inactivity period as the best option to mitigate regulatory exposure because a plain reading of, for example, Rec. 39 is that a maximum retention period must be defined as a policy organizationally.
  - tehabe 6y ago
    This is a weird interpretation of privacy law and makes no sense to me. If I upload a file to Google Drive I expect them to be there as long as I don't delete the file. You could argue, that emptying the bin after 30 days would be needed to fulfill those requirements. But having an inactive account shouldn't. These privacy laws mostly deals with all the other data Google is collecting about its users while they are using the service.

tehabe 6y ago

This doesn't really apply here, this is about data which is stored by the users on the services for being stored on those services according to the ToS of Google. So, it the purpose is only expired when a user decides to delete the data.

joshuakelly 6y ago
In general, the consumer data privacy laws in regions where Google has significant regulatory exposure do not permit indefinite data retention of PII. My speculation is that Google sees an across the board, 2-year inactivity period as the best option to mitigate regulatory exposure because a plain reading of, for example, Rec. 39 is that a maximum retention period must be defined as a policy organizationally.
- tehabe 6y ago
  This is a weird interpretation of privacy law and makes no sense to me. If I upload a file to Google Drive I expect them to be there as long as I don't delete the file. You could argue, that emptying the bin after 30 days would be needed to fulfill those requirements. But having an inactive account shouldn't. These privacy laws mostly deals with all the other data Google is collecting about its users while they are using the service.