6 ms·

I wonder if you can, under GDPR, request that all your data is deleted and then create a new account. Not allowing you to create a new account could be argued a

by rdfi 4y ago

I wonder if you can, under GDPR, request that all your data is deleted and then create a new account. Not allowing you to create a new account could be argued as a violation of GDPR as it would mean that they kept personally identifiable data about you.

maxpro 4y ago
Not really, as GDPR is not only about screwing up big companies. Certain kind of data must be saved by companies (like financial transactions). You can request the deletion, but they are still allowed to save some of the data.
andylynch 4y ago
Keeping PII for fraud detection is not barred by GDPR. In this context the more relevant aspect of GDPR, which I think receives too little attention and more so enforcement, is article 22 (Automated individual decision-making, including profiling)
WaxProlix 4y ago
This is what I was going to say. As an American, I have no recourse in these situations. Europeans are fortunate to have governing bodies with at least some teeth. Not sure how that applies to UK citizens post-Brexit, though.
- conradfr 4y ago
  They have the UK-GDPR now. https://www.cookiebot.com/en/uk-gdpr/ https://www.cookiebot.com/en/uk-gdpr/
- rootusrootus 4y ago
  > As an American A bit over 10% (and probably somewhat higher than 10% on HN) of Americans do have something like GDPR. California Consumer Privacy Act. I'm not including Colorado, Virginia, or Utah because I'm not sure how equivalent their laws are.
- vageli 4y ago
  > This is what I was going to say. As an American, I have no recourse in these situations. Europeans are fortunate to have governing bodies with at least some teeth. Not sure how that applies to UK citizens post-Brexit, though. GDPR applies to all individuals in the EU, not just citizens.
dylan604 4y ago
If I were trying to be sneaky, could you create a series of hashes of the name/email/address/bank type of info to stored on GDPR deletion request that could then be checked against any new account creation? Since the only data stored after deletion would be a hash with no PII remaining, is this a viable workaround?
- liaukovv 4y ago
  If you can use hash to identify someone then its pii by definition
  - anonymousiam 4y ago
    I do not agree. The identity can be extended with some GUID and then hashed. The GUID and hash can be kept, but the identity discarded. Then the original identity is lost, but if encountered again, it will be known that it was previously seen.
    - bentcorner 4y ago
      It's not clear to me how from a privacy perspective that's different from the hash of an id.
      - anonymousiam 4y ago
        It's different because a hash of the ID can be used by anyone who knows the hashing algorithm. If the ID is combined with a UUID/GUID and the UUID/GUID is kept secret/isolated by the entity doing verification, then nobody else can make use of the hash, even those within the entity organization who do not have access to the UUID/GUID. The UUID/GUID itself is not PII so it can probably be retained without violating the GDPR. The same goes for the hash. And since there is no way to reconstruct the original ID given the UUID/GUID and hash, there should be no GDPR violation. In a large entity such as Google, you almost need to outsource ID verification to ensure it's not abused by other (advertising/marketing) parts of Google. Of course all of this requires good faith on the part of the implementing entity, which is certainly not guaranteed.
kurupt213 4y ago
Is this a way around Reddit bans?
chias 4y ago
Generally, no. GDPR specifically carves out keeping data for "legitimate business needs" including fraud prevention and so on. Whatever data Ebay (thinks it) has about this person that they are using to enforce the ban would be data that they would argue falls under this clause.
- Aeolun 4y ago
  This is circular. If there was no reason to ban him then keeping the data for fraud prevention purposes obviously doesn’t hold any water.
rcxdude 4y ago
keeping information for the purposes of enforcing rules and bans is explicitly allowed in GDPR and you are not forced to delete it. (similarly, you can't ask a company to delete all the stuff you've bought and sold them from their accounts)
- londons_explore 4y ago
  However many companies are sufficiently scared of the GDPR and potentially keeping data they shouldn't accidentally that they will just delete everything about you. You can totally use that to get the 'new customer discount' again at Uber for example...
teraflop 4y ago
Contrary to popular understanding, the GDPR does not allow you to force a company to delete all data about you. In effect, it lets you revoke your consent for the company to store and process your data. But it also provides for cases where your data can be processed without your consent. It's not an unlimited carte blanche, but fraud prevention is explicitly given as an example of a legitimate purpose.
- cj 4y ago
  This is correct. Businesses are allowed to retain information necessary to operate. Which would include things like names, email addresses, IP addresses, etc of people who are banned (to prevent them from returning). If GDPR required a company to delete everything, it would be impractical. (E.g. imagine you request a company delete your info, and then you immediately sue them for something that happened while using their product/service… the company wouldn’t be able to defend themselves unless they retained a record/logs of your usage. You can submit a deletion request, but in most cases much of your data won’t actually be deleted.
  - varsketiz 4y ago
    > Which would include things like names, email addresses, IP addresses, etc of people who are banned (to prevent them from returning). I'm not sure about that. The company might reason it needs this data to operate, but you should be able to contest that with a data protection authority. The data that you can not request to delete is for example money transaction data, which the company has to retain for 10 years or so due to other laws.
    - cj 4y ago
      Curious - has anyone here submitted a complaint to a data authority? I wonder what that process is like.
      - varsketiz 4y ago
        I have. It was about a company that kept spamming me with SMSes. I had to file an archaic form for a government agency. It took a while, I received a few emails about progress and asking for additional details. The spam stopped.
shadowgovt 4y ago
Keeping that data to maintain a ban seems self-evidently in the space of "needed for the health and operation of the service." At the very least, I'm sure eBay lawyers would be happy to argue the point.
tchvil 4y ago
Thank you for the hint. Will do that. I was banned the same way as the OP, few months ago. They(humans)collected my Id, bank details, personal address, original invoice of the items I was selling, some calls, to finally ban my 15+ year user.
linker3000 4y ago
Also, under the GDPR, you may have the right for any solely-automated decision making about you to then involve a human: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/automated-decision-making-and-profiling/what-does-the-uk-gdpr-say-about-automated-decision-making-and-profiling/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Mind you, there's nothing to stop eBay from having someone now look at your data and go 'nope'.
- soco 4y ago
  ...or claiming "yup I looked"
Archelaos 4y ago
Under GDPR, a company may retain personal data if it has a legitimate interest in doing so. To what extent this applies here, I do not know. You might have a chance to successfully challenge the termination by legal means, if you actually did not violate Ebay's terms and conditions.
- ryan-c 4y ago
  "For fraud prevention purposes" is a legitimate interest, so the probably won't work.
- deleted 4y ago
  [deleted]
NonNefarious 4y ago
Love that idea.
lettergram 4y ago
They probably check an external list upon account creation. If the ban had to do with KYC (Know-your-customer) and the user is on or unintentionally confused with a banned entity, then it doesn’t matter.
abvdj2 4y ago
that's wrong, they are allowed to keep some data
izacus 4y ago
No, fraud prevention is one of the widely accepted reasons for data storage under GDPR.

by rdfi 4y ago

maxpro 4y ago

Not really, as GDPR is not only about screwing up big companies. Certain kind of data must be saved by companies (like financial transactions). You can request the deletion, but they are still allowed to save some of the data.

andylynch 4y ago

Keeping PII for fraud detection is not barred by GDPR. In this context the more relevant aspect of GDPR, which I think receives too little attention and more so enforcement, is article 22 (Automated individual decision-making, including profiling)

WaxProlix 4y ago

This is what I was going to say. As an American, I have no recourse in these situations. Europeans are fortunate to have governing bodies with at least some teeth. Not sure how that applies to UK citizens post-Brexit, though.

conradfr 4y ago
They have the UK-GDPR now. https://www.cookiebot.com/en/uk-gdpr/ https://www.cookiebot.com/en/uk-gdpr/
rootusrootus 4y ago
> As an American A bit over 10% (and probably somewhat higher than 10% on HN) of Americans do have something like GDPR. California Consumer Privacy Act. I'm not including Colorado, Virginia, or Utah because I'm not sure how equivalent their laws are.
vageli 4y ago
> This is what I was going to say. As an American, I have no recourse in these situations. Europeans are fortunate to have governing bodies with at least some teeth. Not sure how that applies to UK citizens post-Brexit, though. GDPR applies to all individuals in the EU, not just citizens.

dylan604 4y ago

If I were trying to be sneaky, could you create a series of hashes of the name/email/address/bank type of info to stored on GDPR deletion request that could then be checked against any new account creation? Since the only data stored after deletion would be a hash with no PII remaining, is this a viable workaround?

liaukovv 4y ago
If you can use hash to identify someone then its pii by definition
- anonymousiam 4y ago
  I do not agree. The identity can be extended with some GUID and then hashed. The GUID and hash can be kept, but the identity discarded. Then the original identity is lost, but if encountered again, it will be known that it was previously seen.
  - bentcorner 4y ago
    It's not clear to me how from a privacy perspective that's different from the hash of an id.
    - anonymousiam 4y ago
      It's different because a hash of the ID can be used by anyone who knows the hashing algorithm. If the ID is combined with a UUID/GUID and the UUID/GUID is kept secret/isolated by the entity doing verification, then nobody else can make use of the hash, even those within the entity organization who do not have access to the UUID/GUID. The UUID/GUID itself is not PII so it can probably be retained without violating the GDPR. The same goes for the hash. And since there is no way to reconstruct the original ID given the UUID/GUID and hash, there should be no GDPR violation. In a large entity such as Google, you almost need to outsource ID verification to ensure it's not abused by other (advertising/marketing) parts of Google. Of course all of this requires good faith on the part of the implementing entity, which is certainly not guaranteed.

kurupt213 4y ago

Is this a way around Reddit bans?

chias 4y ago

Generally, no. GDPR specifically carves out keeping data for "legitimate business needs" including fraud prevention and so on. Whatever data Ebay (thinks it) has about this person that they are using to enforce the ban would be data that they would argue falls under this clause.

Aeolun 4y ago
This is circular. If there was no reason to ban him then keeping the data for fraud prevention purposes obviously doesn’t hold any water.

rcxdude 4y ago

keeping information for the purposes of enforcing rules and bans is explicitly allowed in GDPR and you are not forced to delete it. (similarly, you can't ask a company to delete all the stuff you've bought and sold them from their accounts)

londons_explore 4y ago
However many companies are sufficiently scared of the GDPR and potentially keeping data they shouldn't accidentally that they will just delete everything about you. You can totally use that to get the 'new customer discount' again at Uber for example...

teraflop 4y ago

Contrary to popular understanding, the GDPR does not allow you to force a company to delete all data about you. In effect, it lets you revoke your consent for the company to store and process your data. But it also provides for cases where your data can be processed without your consent. It's not an unlimited carte blanche, but fraud prevention is explicitly given as an example of a legitimate purpose.

cj 4y ago
This is correct. Businesses are allowed to retain information necessary to operate. Which would include things like names, email addresses, IP addresses, etc of people who are banned (to prevent them from returning). If GDPR required a company to delete everything, it would be impractical. (E.g. imagine you request a company delete your info, and then you immediately sue them for something that happened while using their product/service… the company wouldn’t be able to defend themselves unless they retained a record/logs of your usage. You can submit a deletion request, but in most cases much of your data won’t actually be deleted.
- varsketiz 4y ago
  > Which would include things like names, email addresses, IP addresses, etc of people who are banned (to prevent them from returning). I'm not sure about that. The company might reason it needs this data to operate, but you should be able to contest that with a data protection authority. The data that you can not request to delete is for example money transaction data, which the company has to retain for 10 years or so due to other laws.
  - cj 4y ago
    Curious - has anyone here submitted a complaint to a data authority? I wonder what that process is like.
    - varsketiz 4y ago
      I have. It was about a company that kept spamming me with SMSes. I had to file an archaic form for a government agency. It took a while, I received a few emails about progress and asking for additional details. The spam stopped.

shadowgovt 4y ago

Keeping that data to maintain a ban seems self-evidently in the space of "needed for the health and operation of the service." At the very least, I'm sure eBay lawyers would be happy to argue the point.

tchvil 4y ago

Thank you for the hint. Will do that. I was banned the same way as the OP, few months ago. They(humans)collected my Id, bank details, personal address, original invoice of the items I was selling, some calls, to finally ban my 15+ year user.

linker3000 4y ago

Also, under the GDPR, you may have the right for any solely-automated decision making about you to then involve a human: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/automated-decision-making-and-profiling/what-does-the-uk-gdpr-say-about-automated-decision-making-and-profiling/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Mind you, there's nothing to stop eBay from having someone now look at your data and go 'nope'.

soco 4y ago
...or claiming "yup I looked"

Archelaos 4y ago

Under GDPR, a company may retain personal data if it has a legitimate interest in doing so. To what extent this applies here, I do not know. You might have a chance to successfully challenge the termination by legal means, if you actually did not violate Ebay's terms and conditions.

ryan-c 4y ago
"For fraud prevention purposes" is a legitimate interest, so the probably won't work.
deleted 4y ago
[deleted]

NonNefarious 4y ago

Love that idea.

lettergram 4y ago

They probably check an external list upon account creation. If the ban had to do with KYC (Know-your-customer) and the user is on or unintentionally confused with a banned entity, then it doesn’t matter.

abvdj2 4y ago

that's wrong, they are allowed to keep some data

izacus 4y ago

No, fraud prevention is one of the widely accepted reasons for data storage under GDPR.