5 ms·

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merch

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

Traster 4y ago
If it really keeps credit card details, that’s way more than just a tombstone.
- fshbbdssbbgdd 4y ago
  (Asking out of ignorance, I don’t know how this works) Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
  - marcofatica 4y ago
    They could mail a check.. oops now they need your mailing address Or they could call you and ask.. oops now they need your phone number etc
  - Traster 4y ago
    In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".
    - fshbbdssbbgdd 4y ago
      In general, it’s not that strange to sell something then realize you can’t actually deliver it and make a refund. I guess HelloFresh is a little bit different from the average e-commerce business because they sell perishable food. But probably there’s some case where they would take some money then later decide to give it back.
  - rrobukef 4y ago
    Encrypted archival of PII for a limited time, say a year. GDPR allows the storage for legal reasons. A one way hash of PII, salted, stretched, this is enough to verify identity but also doesn't keep the PII directly (I know only 8 billion people on earth is not enough entropy. Still you make a legal effort and segregate it from your network)
  - aPoCoMiLogin 4y ago
    you only need the transaction details to call your payment gateway to do the refund, unless you are the payment gateway.
zxienin 4y ago
Correct for transaction data. Such data is owned by hello fresh and they need to keep it (for financial reporting, for instance). However OP talked of master data. That should be removed when user asks to delete their account.
oliwarner 4y ago
You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it. No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they're just moving it to be inaccessible to the user. They keep the data. And that's a) scummy and b) illegal in several jurisdictions.
- otterley 4y ago
  If the records no longer contain PII, then they've arguably satisfied their duties under the law, haven't they? Has a court held otherwise?
  - oliwarner 4y ago
    But the records do. > Your account showing your name, address, credit card, etc can still be accessed whilst the token stored in the cookie is still valid
    - zbuf 4y ago
      They're also given time for the deletion to be fully complete -- backups etc.. That could apply here.
- edmundsauto 4y ago
  I think replacing the userid with an ID that isn’t reversible but keeps all the foreign key constraints is acceptable.

Traster 4y ago

If it really keeps credit card details, that’s way more than just a tombstone.

fshbbdssbbgdd 4y ago
(Asking out of ignorance, I don’t know how this works) Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?
- marcofatica 4y ago
  They could mail a check.. oops now they need your mailing address Or they could call you and ask.. oops now they need your phone number etc
- Traster 4y ago
  In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".
  - fshbbdssbbgdd 4y ago
    In general, it’s not that strange to sell something then realize you can’t actually deliver it and make a refund. I guess HelloFresh is a little bit different from the average e-commerce business because they sell perishable food. But probably there’s some case where they would take some money then later decide to give it back.
- rrobukef 4y ago
  Encrypted archival of PII for a limited time, say a year. GDPR allows the storage for legal reasons. A one way hash of PII, salted, stretched, this is enough to verify identity but also doesn't keep the PII directly (I know only 8 billion people on earth is not enough entropy. Still you make a legal effort and segregate it from your network)
- aPoCoMiLogin 4y ago
  you only need the transaction details to call your payment gateway to do the refund, unless you are the payment gateway.

zxienin 4y ago

Correct for transaction data. Such data is owned by hello fresh and they need to keep it (for financial reporting, for instance). However OP talked of master data. That should be removed when user asks to delete their account.

oliwarner 4y ago

You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it. No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they're just moving it to be inaccessible to the user. They keep the data. And that's a) scummy and b) illegal in several jurisdictions.

otterley 4y ago
If the records no longer contain PII, then they've arguably satisfied their duties under the law, haven't they? Has a court held otherwise?
- oliwarner 4y ago
  But the records do. > Your account showing your name, address, credit card, etc can still be accessed whilst the token stored in the cookie is still valid
  - zbuf 4y ago
    They're also given time for the deletion to be fully complete -- backups etc.. That could apply here.
edmundsauto 4y ago
I think replacing the userid with an ID that isn’t reversible but keeps all the foreign key constraints is acceptable.