internet gdpr privacy
Is it possible to receive copy of deleted facebook messenger messages under GDPR?
<p>Is it possible to receive copy of deleted private facebook messenger messages under GDPR if two recipients deleted them?</p>

<p>If Facebook still has a copy of your deleted messages, and if Facebook is able to tell that these messages are your messages, then Facebook should produce a copy of these messages in response to a data subject access request (DSAR).</p>
<p>But the important words are “if” and “should”.</p>
<p>From the outside, it is not possible to tell how Facebook manages deleted messages. When both users delete a message, is this a soft-delete that merely hides a message, or does Facebook actually delete their message from the servers? If the message is actually deleted (which would be a GDPR-compliant approach), then it obviously cannot be produced in response to a DSAR.</p>
<p>The next problem is that Facebook is not known for being a particularly helpful data controller, and often makes it difficult for users to actually exercise their GDPR rights. So even if these messages still exist, it is possible that Facebook would be (illegally) withholding them in a DSAR response. In 2019, Ruben Verborgh <a href="https://ruben.verborgh.org/facebook/" rel="nofollow noreferrer">chronicled his efforts to exercise a DSAR</a> that goes beyond the incomplete “download my data” tool. It doesn't seem like he ever got the data he sought.</p>

<p>Just because the two people in the messenger deleted the messages doesn't mean that Facebook deleted them. It just means that the two people in the messenger (assuming there were only two) deleted them. At times when Facebook malfunctions, deleted messages reappear for a short time. This means that FB has them. So it's possible to get pretty much everything we've ever sent via messenger, you just need to convince them to give it to you. May need some kind of warrant or subpoena.</p>
