internet privacy european-union
Do I have to allow users to delete their acounts?
<p>On my web app, the only personal information that I ask users for when they sign in is their e-mail address.</p>

<p>The e-mail address is not shown to any other users, but one can check if a user exists with a given e-mail address (by trying to create a new account with the same address, since only one account per address is allowed).</p>

<p>Am I legally required to allow users to delete their account?
I am especially interested in European law.</p>

<p>Thank you very much in advance.</p>

<p>As of fall 2015, the "International Safe Harbor Privacy Principles" are no longer sufficient in Europe.  New regulations, written by the <a href="http://ec.europa.eu/justice/data-protection/article-29/index_en.htm" rel="nofollow">Article 29 Data Protection Working Party</a>, came out in spring 2016 and information on this group, including regulatory text, can be found <a href="http://ec.europa.eu/justice/data-protection/index_en.htm" rel="nofollow">here</a>.  </p>

<p>On their site, the page "<a href="http://ec.europa.eu/justice/data-protection/individuals/rights/index_en.htm" rel="nofollow">Protecting your data: your rights</a>" states that users can ask several things of "persons or entities which collect your personal data" including:</p>

<blockquote>
  <ul>
  <li>You have the right to ask for the deletion, blocking or erasing of the data.  </li>
  </ul>
</blockquote>

<p>On a page listing <a href="http://ec.europa.eu/justice/data-protection/data-collection/obligations/index_en.htm" rel="nofollow">obligations</a> of those who collect personal data, it says: </p>

<blockquote>
  <ul>
  <li>Data controllers must ensure that data subjects can rectify, remove or block incorrect data about themselves.  </li>
  <li>Data that identifies individuals (personal data) must not be kept any longer than strictly necessary.</li>
  </ul>
</blockquote>

<p>In the <a href="http://ec.europa.eu/justice/data-protection/document/index_en.htm" rel="nofollow">documents section</a>, their January 2016 Fact Sheet titled "<a href="http://How%20does%20the%20data%20protection%20reform%20strengthen%20citizens&#39;%20rights?" rel="nofollow">How does the data protection reform strengthen citizens' rights?</a>" states:</p>

<blockquote>
  <p>If you no longer want your personal data to be processed, and there is no legitimate reason for a company to keep it, the data shall be deleted.</p>
</blockquote>

<p>For the reasons listed above, I conclude that in most cases, you <strong>should</strong> accept and comply with user requests for account deletion.  There are likely exceptions, such as if you and the user have some active dispute and the data stored in the account would be evidence in resolving that dispute, but hopefully that is a small minority of account deletion requests. </p>

<p>Well, WBT's answer answers the question with one semi-exception (not necessarily applicable in your case). In particular, this: "and there is no legitimate reason for a company to keep it". There are many online forums where people post stuff is discussion form, and it could be highly disruptive to the integrity of the forum if posts were suddenly deleted (responses would be non-sequitur). Preserving the structure of a discussion is a legitimate reason to keep those posts. Now theoretically it might be possible to delete the underlying personal data (the person's email address), but generally speaking this is not something that can be controlled by a normal site administrator. It is therefore reasonable to not delete such data, since it is typically not possible to do without disrupting the site or imposing a huge burden on the site (imaging having to manually edit all of the posts on Stackexchange to eliminate any reference to an individual). </p>

<p>Also note that many people understand "delete my account" to include "delete anything that I have posted", not just "delete my email address".</p>
