8 ms·

PSA: HelloFresh doesn't delete data when asked, only changes the email address

78 points by seasicksteve 4y ago

Asking HelloFresh to delete your data will simply result in them changing the email address on your account to hellofreshcustomer-<customer id>@hellofresh.de Your account showing your name, address, credit card, etc can still be accessed whilst the token stored in the cookie is still valid

u09h03eoyvh 4y ago
Tumblr just added an deactivated- in front of the actual address IIRC. Since I have an catchall for my own domain I received spam on those addresses after they lost customers data.
FrenchDevRemote 4y ago
you can't instantly delete user data because of safety/liability reasons
- valbaca 4y ago
  Article 17 of the GDPR would disagree. """ “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month. """
  - cronix 4y ago
    Does that include data contained in their x years of backups?
    - Someone 4y ago
      What companies keep x years of backups (for any x > 1, possibly even ½)? I don’t think that’s worth much to any company. Better make sure your recent backups are good than spend effort on keeping such old backups around. For accounting/tax purposes, you need data up to typically 7-ish years ago, but isn’t that data typically online nowadays so that it will end up in today’s backup? Even if they still have the bits from an old backup, they should have thrown away its encryption key.
    - Symbiote 4y ago
      Yes, so it's important to distinguish between backups and archives. If you're keeping data for years, it's an archive and not a backup.
  - deleted 4y ago
    [deleted]
  - ehhthing 4y ago
    30 days is not instant. The only issue here is HelloFresh not properly telling its customers how long it takes for them to actually delete the data.
  - btgeekboy 4y ago
    That doesn’t seem to contradict what the parent comment suggests.
marrone12 4y ago
This is generally standard practice for e-commerce companies, is it not?
- shockeychap 4y ago
  It is common for companies to randomize all data containing PII. It's not common for them to obfuscate one data point and leave all the others alone.
  - shmoogy 4y ago
    An internal ID for a customer record is probably tied to the orders and other internal data. Deleting a record just breaks shit you might need for historical purposes. It's better to disassociate the customer info and maintain the other links - unless there is an obligation to do so otherwise (unfamiliar with gdrp nuances) Randomizing multiple foreign keys at the same time is interesting though. Is it really necessary if the company isn't intentionally being malicious trying to maintain and advertise to the requesting individual ?
hallman76 4y ago
CCPA provides a handful of reasons that allow a business to maintain data even after you request to be deleted: https://cdp.cooley.com/ccpa-2018/#section-1798-105 https://cdp.cooley.com/ccpa-2018/#section-1798-105
clankyclanker 4y ago
Right. For most (American) companies (I don’t know about GDPR-folks), “delete” means “hide from requesting user” not “remove data from internal system.” Data is (at least a big part of) their business and they don’t further that end by removing data. Of course it’s shitty, but it’s industry standard practice. It’s similar to the Facebook shadow profile you have when you don’t even have a Facebook account: you can ask them to delete your direct data, but they’ll never remove the implications they learned from that data.
- cronix 4y ago
  Also, if they do delete it from "current db," they likely have years of backups. I find it difficult to believe someone like FB (or any other) would unarchive multiple terrabyte archives from storage, restore them (db, etc), delete the data, and rearchive them, for each daily/weekly/monthly/yearly backup my data is contained within.
  - charleslmunger 4y ago
    I have no knowledge of how Facebook or anybody else does their backup deletion - but one way to accomplish this is to encrypt parts of the backups with a per user key, and delete the key when deletion is requested - tapes (or whatever) stay in cold storage but the data is irretrievable.
- duxup 4y ago
  I don't doubt that's it but as also dev my first inclination is to soft delete most anything. Later do a real delete to avoid any mistakes. Atlassian maybe could have used that ...
nerdjon 4y ago
Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the exception). I would gladly add a couple days of transit time and pay a bit to catch the companies selling my information.
- 0x0000000 4y ago
  If you don't need to use the second line for "Street Address", you might be able to repurpose it and put in a unique identifier for each entity you conduct business with. Might depend on your mail carrier being OK with putting a letter to "Apt 41723" in the only mailbox at the primary address.
  - jgalt212 4y ago
    Does the USPS Address Verification API reject such "modifications"? https://www.usps.com/business/web-tools-apis/ https://www.usps.com/business/web-tools-apis/
    - yurishimo 4y ago
      The OP linked the German version of hello fresh so likely moot.
    - gruez 4y ago
      Maybe. On one hand USPS might have a database of which buildings are multi-family homes and reject stuff like "unit 123" if it's not a multi-family/tenant building. However, I've also seen letters addressed to "basement" (for someone who's renting out the basement of a single family home) which seem to arrive fine so maybe they're not doing too aggressive filtering.
- mrsuprawsm 4y ago
  >It does bring up an interesting idea, how many people use unique emails for each company to track spam Probably not a lot, but Apple's "Hide my Email" feature is now native to iOS and should in theory make this fairly easy to do. I do this _occasionally_ when signing up for new sites.
legitster 4y ago
One of the bizarre machinations that our legal team determined is that you should be able to delete your data and still be a customer. Which means retaining all sorts of billing information until you actually delete your account. Did you try reaching out to HelloFresh about this? At our company all GDPR requests are manually serviced. You can likely get a human being to respond.
duxup 4y ago
Is this "forever" or possibly a sort of soft delete pending something else?
mrsuprawsm 4y ago
Sadly many companies do the same thing, violating the GDPR, even EU-based companies who know better. I wonder if engineers who built and have knowledge of these systems could anonymously disclose/leak details of violations to a site pairing them with other engineers. The other engineers could submit a GDPR forget-me request, which the company wouldn't be able to fulfil, and then people could complain to the national regulators with specific instructions on how to find said not-actually-deleted information. Obviously it would violate non-disclosure agreements, but I'd imagine that would get companies to clean up their act fairly quickly, or at least it would if the national regulators had more teeth.
- Symbiote 4y ago
  The lawyers we consulted said the biggest risk for a company without many individual customers was their own employees. A disgruntled former employee makes a GDPR request, etc.
closeparen 4y ago
I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.
- Traster 4y ago
  If it really keeps credit card details, that’s way more than just a tombstone.
  - fshbbdssbbgdd 4y ago
    (Asking out of ignorance, I don’t know how this works) Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
    - marcofatica 4y ago
      They could mail a check.. oops now they need your mailing address Or they could call you and ask.. oops now they need your phone number etc
    - Traster 4y ago
      In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".
      - fshbbdssbbgdd 4y ago
        In general, it’s not that strange to sell something then realize you can’t actually deliver it and make a refund. I guess HelloFresh is a little bit different from the average e-commerce business because they sell perishable food. But probably there’s some case where they would take some money then later decide to give it back.
riddleronroof 4y ago
Well that’s fresh. But if the user data is anonymized, it’s OK, right? I’m assuming there isn’t any other PII.
- stkdump 4y ago
  Well depends on how you define PII > name, address, credit card, etc.
the-anarchist 4y ago
That is not news. That is how most of the industry works.
oliwarner 4y ago
Also worth noting that if you're using them to hit your 5:2 fast day calories, the nutritional information on their recipe cards is junk. They might have been accurate once upon a time, but I suspect they sub ingredients and suppliers out as the prices change. The "splash of oil" is hilarious. 100kcal a go. Convenient and interesting as they are, you have to do your own maths and adjust portion sizes accordingly. By the time you've done that, it's easier to just cook something you're used to cooking @500kcal. https://twitter.com/oliw/status/1490985345521172482 https://twitter.com/oliw/status/1490985345521172482
brezelgoring 4y ago
A [CTRL]+[F] for 'Pinterest' yielded no results. They do the same, and you can check, go make an account with your e-mail, and then ask to delete it, they just change it to name@domain.com-wrongpleasefix You can no longer log in and the account is still there.

78 points by seasicksteve 4y ago

u09h03eoyvh 4y ago

Tumblr just added an deactivated- in front of the actual address IIRC. Since I have an catchall for my own domain I received spam on those addresses after they lost customers data.

FrenchDevRemote 4y ago

you can't instantly delete user data because of safety/liability reasons

valbaca 4y ago
Article 17 of the GDPR would disagree. """ “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month. """
- cronix 4y ago
  Does that include data contained in their x years of backups?
  - Someone 4y ago
    What companies keep x years of backups (for any x > 1, possibly even ½)? I don’t think that’s worth much to any company. Better make sure your recent backups are good than spend effort on keeping such old backups around. For accounting/tax purposes, you need data up to typically 7-ish years ago, but isn’t that data typically online nowadays so that it will end up in today’s backup? Even if they still have the bits from an old backup, they should have thrown away its encryption key.
  - Symbiote 4y ago
    Yes, so it's important to distinguish between backups and archives. If you're keeping data for years, it's an archive and not a backup.
- deleted 4y ago
  [deleted]
- ehhthing 4y ago
  30 days is not instant. The only issue here is HelloFresh not properly telling its customers how long it takes for them to actually delete the data.
- btgeekboy 4y ago
  That doesn’t seem to contradict what the parent comment suggests.

marrone12 4y ago

This is generally standard practice for e-commerce companies, is it not?

shockeychap 4y ago
It is common for companies to randomize all data containing PII. It's not common for them to obfuscate one data point and leave all the others alone.
- shmoogy 4y ago
  An internal ID for a customer record is probably tied to the orders and other internal data. Deleting a record just breaks shit you might need for historical purposes. It's better to disassociate the customer info and maintain the other links - unless there is an obligation to do so otherwise (unfamiliar with gdrp nuances) Randomizing multiple foreign keys at the same time is interesting though. Is it really necessary if the company isn't intentionally being malicious trying to maintain and advertise to the requesting individual ?

hallman76 4y ago

CCPA provides a handful of reasons that allow a business to maintain data even after you request to be deleted: https://cdp.cooley.com/ccpa-2018/#section-1798-105 https://cdp.cooley.com/ccpa-2018/#section-1798-105

clankyclanker 4y ago

Right. For most (American) companies (I don’t know about GDPR-folks), “delete” means “hide from requesting user” not “remove data from internal system.” Data is (at least a big part of) their business and they don’t further that end by removing data. Of course it’s shitty, but it’s industry standard practice. It’s similar to the Facebook shadow profile you have when you don’t even have a Facebook account: you can ask them to delete your direct data, but they’ll never remove the implications they learned from that data.

cronix 4y ago
Also, if they do delete it from "current db," they likely have years of backups. I find it difficult to believe someone like FB (or any other) would unarchive multiple terrabyte archives from storage, restore them (db, etc), delete the data, and rearchive them, for each daily/weekly/monthly/yearly backup my data is contained within.
- charleslmunger 4y ago
  I have no knowledge of how Facebook or anybody else does their backup deletion - but one way to accomplish this is to encrypt parts of the backups with a per user key, and delete the key when deletion is requested - tapes (or whatever) stay in cold storage but the data is irretrievable.
duxup 4y ago
I don't doubt that's it but as also dev my first inclination is to soft delete most anything. Later do a real delete to avoid any mistakes. Atlassian maybe could have used that ...

nerdjon 4y ago

Somehow this doesn't surprise me, they still want to be able to spam you with offers (I legit got a text today from Martha and Marley, I have not used them for 3+ years) and possibly sell your data to make more money. It does bring up an interesting idea, how many people use unique emails for each company to track spam. If something like that was possible for shipped goods (wouldn't work well for food but that is the exception). I would gladly add a couple days of transit time and pay a bit to catch the companies selling my information.

0x0000000 4y ago
If you don't need to use the second line for "Street Address", you might be able to repurpose it and put in a unique identifier for each entity you conduct business with. Might depend on your mail carrier being OK with putting a letter to "Apt 41723" in the only mailbox at the primary address.
- jgalt212 4y ago
  Does the USPS Address Verification API reject such "modifications"? https://www.usps.com/business/web-tools-apis/ https://www.usps.com/business/web-tools-apis/
  - yurishimo 4y ago
    The OP linked the German version of hello fresh so likely moot.
  - gruez 4y ago
    Maybe. On one hand USPS might have a database of which buildings are multi-family homes and reject stuff like "unit 123" if it's not a multi-family/tenant building. However, I've also seen letters addressed to "basement" (for someone who's renting out the basement of a single family home) which seem to arrive fine so maybe they're not doing too aggressive filtering.
mrsuprawsm 4y ago
>It does bring up an interesting idea, how many people use unique emails for each company to track spam Probably not a lot, but Apple's "Hide my Email" feature is now native to iOS and should in theory make this fairly easy to do. I do this _occasionally_ when signing up for new sites.

legitster 4y ago

One of the bizarre machinations that our legal team determined is that you should be able to delete your data and still be a customer. Which means retaining all sorts of billing information until you actually delete your account. Did you try reaching out to HelloFresh about this? At our company all GDPR requests are manually serviced. You can likely get a human being to respond.

duxup 4y ago

Is this "forever" or possibly a sort of soft delete pending something else?

mrsuprawsm 4y ago

Sadly many companies do the same thing, violating the GDPR, even EU-based companies who know better. I wonder if engineers who built and have knowledge of these systems could anonymously disclose/leak details of violations to a site pairing them with other engineers. The other engineers could submit a GDPR forget-me request, which the company wouldn't be able to fulfil, and then people could complain to the national regulators with specific instructions on how to find said not-actually-deleted information. Obviously it would violate non-disclosure agreements, but I'd imagine that would get companies to clean up their act fairly quickly, or at least it would if the national regulators had more teeth.

Symbiote 4y ago
The lawyers we consulted said the biggest risk for a company without many individual customers was their own employees. A disgruntled former employee makes a GDPR request, etc.

closeparen 4y ago

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

Traster 4y ago
If it really keeps credit card details, that’s way more than just a tombstone.
- fshbbdssbbgdd 4y ago
  (Asking out of ignorance, I don’t know how this works) Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
  - marcofatica 4y ago
    They could mail a check.. oops now they need your mailing address Or they could call you and ask.. oops now they need your phone number etc
  - Traster 4y ago
    In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".
    - fshbbdssbbgdd 4y ago
      In general, it’s not that strange to sell something then realize you can’t actually deliver it and make a refund. I guess HelloFresh is a little bit different from the average e-commerce business because they sell perishable food. But probably there’s some case where they would take some money then later decide to give it back.

riddleronroof 4y ago

Well that’s fresh. But if the user data is anonymized, it’s OK, right? I’m assuming there isn’t any other PII.

stkdump 4y ago
Well depends on how you define PII > name, address, credit card, etc.

the-anarchist 4y ago

That is not news. That is how most of the industry works.

oliwarner 4y ago

Also worth noting that if you're using them to hit your 5:2 fast day calories, the nutritional information on their recipe cards is junk. They might have been accurate once upon a time, but I suspect they sub ingredients and suppliers out as the prices change. The "splash of oil" is hilarious. 100kcal a go. Convenient and interesting as they are, you have to do your own maths and adjust portion sizes accordingly. By the time you've done that, it's easier to just cook something you're used to cooking @500kcal. https://twitter.com/oliw/status/1490985345521172482 https://twitter.com/oliw/status/1490985345521172482

brezelgoring 4y ago

A [CTRL]+[F] for 'Pinterest' yielded no results. They do the same, and you can check, go make an account with your e-mail, and then ask to delete it, they just change it to name@domain.com-wrongpleasefix You can no longer log in and the account is still there.