5 ms·
The Right to Erasure is not absolute. There are a large number of reasons why they may not be required, or even allowed, to erase some or all of those data poin
by lmkg 4y ago
The Right to Erasure is not absolute. There are a large number of reasons why they may not be required, or even allowed, to erase some or all of those data points.
They are required to explain themselves. Per GDPR Article 12 Paragraph 4, even if they do not delete any data they owe you a response. This would include the legal justifications for not erasing the data.
- x0x0 4y agoI suspect btdmaster is American and, as such, has no GDPR rights wrt Discord, an American company. I don't believe in that case that Discord is required to explain themselves. Separately, OP starts with a complaint about deletion; then complaints about not being able to opt-out (a different discussion than deletion); then states that OP finds this unreasonable under GDPR and CCPA -- which, given Discord is an American company, I struggle to figure out how both would ever apply. Only zero or one will apply to OP. And finally, as you point out, the GDPR right to deletion is not absolute. The data subject has rights, but companies have a legitimate interest in keeping the context of a discussion around, and are also allowed to consider the legitimate interests of others. An analysis would be required to figure out if it is an overriding interest.
- mschuster91 4y ago> The data subject has rights, but companies have a legitimate interest in keeping the context of a discussion around, and are also allowed to consider the legitimate interests of others. An analysis would be required to figure out if it is an overriding interest. Yes, but (at least under GDPR) it is reasonable to demand that Discord removes everything not needed for following legitimate interest of others (e.g. IP address, browser user agent).
- x0x0 4y agoThose can likely be maintained for anti-abuse purposes as well, particularly if OP got blocked. Separately, (1) Discord claims some of this is deleted at 14 days; and (2) good luck getting an overwhelmed DPA to take seriously your complaint that a company stores browser user agent longer than they ought to.
- btdmaster 4y agoThere is no need to assume that, I am covered by GDPR. I listed what the data in question is - tens of megabytes of text providing IP address, location, ISP, etc. is sufficient to personally identify perhaps even better than a name or similar, in entropy-bit terms.
- x0x0 4y agoThen why are you rambling about CCPA? Why are you not clearly stating which country you are in and which DPA you are covered by? Why are you discussing the size of the data -- it makes no difference if you record an IP address once or a billion times?
- btdmaster 4y agoDiscord is registered in California, so it would concern them even given limited GDPR enforcement. Data size matters since it changes, and there is information even in the knowledge of no change happening. I would rather not share my location, and I do not understand how that would help given I have already contacted my DPA.
- x0x0 4y agoCCPA applies to California residents. You are very unlikely to simultaneously be a California resident and an EU/UK resident. So discuss the law that applies. If you are in the EU, your contract is with Discord Netherlands BV.
- tusharsadhwani 4y agoit's not like they'll have different user account behaviours for someone living in California at the moment, compared to someone living in the EU.
- x0x0 4y agoMany companies do, in fact, implement different rules and data retention for those two circumstances. Source: I've helped several, and talked to peers who work in data protection.