8 ms·
Hate to break it to you but banks are not deleting your account immediately when you close it. They legally can't.
by nightski 5y ago
Hate to break it to you but banks are not deleting your account immediately when you close it. They legally can't.
- datavirtue 5y agoIt's simple. Don't offer account deletion. You comply with both in that case.
- bpodgursky 5y ago> all apps that allow for account creation must also allow users to initiate deletion of their account from within the app No, that doesn't seem true.
- wizzwizz4 5y agoWhat bank lets you create an account just from the app? … Okay, the digital-only ones, maybe. But virtually all other banks I've used make you go to a branch.
- zerkten 5y agoRevolut and many other apps allow creation of accounts from the app per local regulations. It may require SSN in the US to complete sign-up, but it's all done through the app and is immediate. The account falls under all the regular retention and reporting requirements, although these companies mitigate some classes of issues with stricter limits, not paying any interest (even though that'd be miniscule), etc.
- SilasX 5y agoI signed up for Schwab (and numerous other financial institutions that were not "banks" per se) without having to go to a branch in person. You usually just submit photos of documents and, in some cases, have your picture taken at your computer.
- wizzwizz4 5y agoAh, yeah, that was the issue; I didn't have documents. I now remember that I could've signed up entirely online, had I had them.
- tekknik 5y agoCongrats, now those docs are stored in a database. Good luck getting them deleted.
- rattlesnakedave 5y agoYes, banks store your information in databases. Not sure what you’re driving at.
- tekknik 5y agoThey certainly don't scan and save images of your identifying documents when you go into the branch. They may store your DL and SSN number. This is a lot less than you volunteering up your identifying documents to a public webserver.
- mritzmann 5y agoI know at least two swiss banks.
- asdf3243245q 5y agoI think most major brick and mortar banks allow you to open account fully online. Try going to random bank websites and click on "open account".
- chipotle_coyote 5y agoThe guidelines apply to creation of accounts within the app, not just anywhere online.
- jen20 5y agoMonzo. Digital-only, but a "real" bank in every sense of the word.
- woobar 5y agoAny bank in America for the last 20 years. I opened my very first account at the branch cause I though they need to see me. Dozens of accounts at multiple financial institutions after that I never had to go to the branch. Most of my accounts held at places that don't have any branches within hundreds of miles. In fact Wells Fargo is famous for opening account for you without you even thinking about it.
- johnebgd 5y agoI remember pre 2008 financial collapse when you could call a banker and they’d open an account for you sight unseen. Now it’s only internet banks that do this. They still require lots of KYC documents to open an account.
- tekknik 5y agoMeanwhile, my experience with 6 bank accounts is exactly the opposite.
- cortesoft 5y agoAll major banks let you create an account without going in to a branch now.
- davidtcook 5y agoANZ Bank, in Australia - and I'm assuming the others of the Big 4 do as well (CBA, NAB and Westpac, that is). It's been added to the App for some account types over the past year or so.
- EastOfTruth 5y agoDoes that apply if you automatically create an "account"?
- TedDoesntTalk 5y agoIt doesn’t actually say the account must be deleted. It says: “…must also allow users to INITIATE deletion of their account” Capitals mine. So I can allow the initiation of deletion but never actually completely delete the account… and my app complies.
- imchillyb 5y ago> So I can allow the initiation of deletion but never actually completely delete the account… and my app complies. @TedDoesntTalk If the users that are requesting account deletions see that your app is purposely not complying, I don't imagine your app will be available for long in the app store. Your response is why Apple is implementing this change in the first place. Screw AOL and all of the rest of you making things impossible to delete, cancel, or otherwise NOT have an account. I sincerely hope you change your tune, and if you don't then I hope you receive a permanent ban from Apple's App Store. Seriously. This kind of bullshit shouldn't exist. If I can make an account easily, then I should be able to delete an account easily. If I cannot, then your business model should collapse around your fuckin' ears.
- runj__ 5y agoIt can just go through a manual review and delete the parts that they're are legally required to delete. While I don't agree with a lot of the money laundering/terror financing laws banks shouldn't have to delete your data if you're trying to avoid taxes or whatever. INITIATION is the important part, if they fail to delete the parts they're required to delete, F them: get them off the app store.
- sokoloff 5y agoThat last phrase (the punishment for violating record deletion laws) was a much softer ending to your post than I was expecting.
- filoleg 5y ago> If I can make an account easily, then I should be able to delete an account easily. Sure, if you can open an account easily, then you should be able to delete an account easily. So if we make opening an account difficult, then it is fine that deleting one would also be difficult. Sounds like an invitation to make opening an account at a bank or a bunch of other services much more difficult aka impossible from the app.
- unityByFreedom 5y agoA deleted bank account is not publicly accessible.
- gregoryl 5y agoNot as a counterpoint, but you'd be mad not to stick "yet" at the end of that.
- ziml77 5y agoYou still likely have a limited window. Once their obligations to keep your info are up, they're likely to purge it. It's a waste of resources to keep that around and not much value. Plus they surely know it's a liability. PII is treated very carefully in regulated industries. The less of it they have, the better.
- 0x000000001 5y agoOnly accessible to the bank and every megacorp they're selling your data to
- fuddle 5y agoCan confirm, I worked at a fintech company previously with a large number of users. They had a "deleted_at" column on the user table in the database. It's not actually deleted.
- nawgz 5y agoIsn't this almost necessarily true for any system which needs an auditable history? Just thinking out loud, of course cascading deletes will fail, so I guess you could avoid using true foreign keys to the user table for things which are truly related, and then you'd know what the user did but presumably no PII... Seems insanely sketchy though. Way cleaner to soft delete if you ever need to recover history, which the fintech context amongs many obviously requires
- codedokode 5y agoYou don't need to delete the rows from the database. Just replace user's name, address and phone with random data.
- sneak 5y agoRegulated financial services must also store the documentation and results for how they verified a user's identity, too. This involves talking to third parties that can tell you if a given user's name matches their tax identifiers, street addresses, phone number, et cetera. Anyone competent is storing both their requests to those external APIs, as well as those responses, for the entirety of the recordkeeping requirement period.
- xxs 5y agoThe company needs 7 to 10 years of audit info. Of course they cannot 'delete' any account.
- oaiey 5y agoAnd not only banks. Everything which has audit or signatures as part of their requirements will have legally required user data after a user leaves.
- xg15 5y agoYour point being? Not deleting data for legal reasons is still better than the data being physically impossible to delete.
- almostdigital 5y agoA large meteor would delete it just fine.
- spaetzleesser 5y agoWith distributed data centers it needs to be a quite sizable meteor though. The dinosaur killer asteroid may not be enough if your redundancy is on the other side of the globe.
- xxs 5y agoKeep your backup tapes in a safe on the other side of the pond, as they say.
- eyelidlessness 5y agoI once worked in a large Meteor codebase and I cannot comment[1]. 1: I can, nothing catastrophic happened. Other than the Meteor codebase.
- dogma1138 5y agoBanks are under a completely different set of regulations so are many other financial companies as well as other sectors like insurance and medical. They have specific regulation regarding record retention.
- xxs 5y agoYes, pretty much anything that has anything to do with anti-money laundering takes 7 to 10 years to even consider forgetting your account.
- not_kurt_godel 5y agoOk, and? 7-10 years isn't forever, or at least certainly not long enough to negate GP's point about blockchain immutability being undesirable as far as account deletion is concerned.
- xxs 5y agoDid I argue that point at all? Such immutable system will absolutely not be applicable to the EU and GDPR unless all the data is encrypted and the encryption keys are not part of the major chain. A lot of firms that deal with personal data may even have snapshots of every single change, sort of immutable - just not global. Again destroying the keys solves the issue of the immediate erasure. The latter is often times impossible due to tape back ups.
- inopinatus 5y agoKYC/audit regs aside, it's also because the account belongs to the bank. The money is held in trust on your behalf, but the amounts are a liability on the institution's balance sheet. This is also why an increase in the balance of your deposit account is referred to as a credit; the statement is written from the bank's perspective, not yours. What you have is partial control of these funds, via instructions to your bank, electronic or otherwise, but since it is merely operated on your behalf, you can't unilaterally delete the account. What you can do, is terminate the relationship with your bank.
- jimmydorry 5y agoThis falls astray of the new Apple requirement though, as I understand it.
- inopinatus 5y agoYou might think that at first, but the distinction can be made for data as well. The argument goes, when is your data, not really your data? How about, when it's actually my records, of your use, of my system. If you allow such a construct, then "deleting your account" could mean, your immediate personal details (or perhaps even just your access credentials) are erased in some fashion, but nothing else. This is how legislation like the GDPR gets motivated, of course. The Apple guidelines reference "usage data" elsewhere, and I imagine that's for similar reasons. The deletion clause itself, rather notably, doesn't.
- doikor 5y agoThe requirement only applies if one can create the account in the app. At least here in Finland that is not an option in any of the local banks apps I have used.
- olau 5y agoI think this way of framing it is perhaps misleading. Yes, it's plainly true that the bank owns (or rents) the hardware, software, databases, etc. and that you're paying for a service through various fees. But IP is much less clear, and the view that "it's my database so it's my data" is not actually universally legal when the data concerns humans.
- KorematsuFredt 5y agoThis is not just banks but (nearly) all companies who deal with payment data will not delete anything related to payment for many many years. In India this use to be 10 years. USA I think it is 5 years.
- AnthonyMouse 5y agoIt's not just banks either. Suppose you're an equipment rental service. But you can't delete the customer's account before they return the equipment (or pay for losing it). Suppose you're a dog kennel. You can't delete the customer's account while you have their dog in your possession. Suppose you're the parole division of the police department. Can the "customer" delete their "account"? This is the problem with dictatorial fiat. The world is full of edge cases.
- gls2ro 5y agoI don't think these are corner cases. If the user is allowed according with their contract or law to delete their account they should be able to request that themselves from within the app. This is what I understand from what Apple is requiring the apps to do. It is very similar with GDPR "Right to erasure"/"right to be forgotten". For your specific cases: - if a user rented something then they should not be allowed legally to close their account until they return or pay the equipment. If that is in the contract then the delete my account button should be disabled until their contract is terminated/closed. - if you're a dog kennel it is the same, the user should keep the account until the dog is returned. - if you are a parole division of the police and the "customer" by law can have their records deleted they should be able to do so.
- AnthonyMouse 5y ago> If the user is allowed according with their contract or law to delete their account they should be able to request that themselves from within the app. This is what I understand from what Apple is requiring the apps to do. But now you're exposing the huge problem. It goes from "everybody has to be able to cancel their account in the app" to having to be a contract lawyer steeped in the specifics of every business arrangement and know the law in a hundred different countries to be able to determine if you're allowed to cancel within the app. Then the app reviewers would either have to be lawyers with plenty of time to make an accurate determination, or they'll be getting it wrong left and right. And it'll obviously be the second one. So now what does the dog kennel owner do, or the OP above, when the app reviewer rejects their excuse?
- brigandish 5y agoThe exact wording Apple have used is "initiate deletion", that's quite different from immediate deletion. For example, you should be able to request that your bank close your account, via the app - is that too much to ask a bank?
- jimnotgym 5y agoNever mind the banks. UK companies have to keep VAT records for 6 years
- dtech 5y agoThis is different from not deleting your account. Having to keep a record of your purchases doesn't mean they can keep track of your hobbies or whatever. GDPR solved this years ago: right to be forgotten does not apply to legal requirements to keep records. Companies must keep those records only for the minimum time though.
- jimnotgym 5y agoWell that's rather flippant. Where does it say that Apple is only talking about social media apps? And what has it got to do with GDPR. Apple are not the GDPR police in my country. But now you mention it, are the app reviewers going to be trained in GDPR and document retention exemptions, or are they just going to hand out bans? Getting sick of the down voting from the Apple fanbois of hn.