privacy hacking
How to respond to a user requesting deletion of their online account
<p>My website occasionally receives requests from users asking for their account to be deleted. The website itself is a dating site that stores messages between users, personal information they add to their public profile, logs and stats about their usage, etc.</p>

<p>While the site currently lets an admin 'deactivate' a user's account such that it no longer appears publicly, actually deleting the user record and its associated data from the database is problematic. Information we'd be deleting about a user is occasionally necessary and always useful.</p>

<p>One alternative I have toyed with would be to attempt to anonymize the user by clearing all personally identifying pieces of information. Reading about the <a href="https://en.wikipedia.org/wiki/De-anonymization" rel="nofollow noreferrer">de-anonymization</a> that occurred with the Netflix dump, it looks as though this could be quite hard to do effectively.</p>

<p>The company is incorporated in New Zealand, the servers are located in the US and users are from all over the world. Here are some relevant points in the Terms and Conditions:</p>

<blockquote>
  <p>If you wish to terminate your membership you must advise [us] by
  e-mail. Termination of your membership is effective from our
  receipt of your e-mail after which time your profile will be removed.</p>
</blockquote>

<p>and</p>

<blockquote>
  <p>[We] will remove records of any conversations, photos or videos of
  a deactivated user upon their removal from the site.
  These records will also be removed from any user who may have
  communicated with the deactivated user.</p>
</blockquote>

<p>How must I respond to this request? Does the site need to have functionality that allows us to completely delete all traces of a user? Would attempting to anonymise a user be sufficient? I understand Facebook allow for your account to be 'deleted', but do their really remove <em>all</em> traces? In the worst case scenario and the database was hacked and dumped online, would we be liable for any deanonymization that occurred? </p>

<p>Your terms and conditions are clear that you must delete the data -  "[We] will remove records of any conversations, photos or videos of a deactivated user upon their removal from the site. These records will also be removed from any user who may have communicated with the deactivated user."</p>

<p>Your obligations under the <a href="http://legislation.govt.nz/act/public/1993/0091/latest/DLM311053.html?search=ts_act%40bill%40regulation%40deemedreg_Consumer%20Guarantees%20Act%201993_resel_25_a" rel="nofollow noreferrer">Consumer Guarantees Act 1993</a> are also clear - you can't mislead consumers - thus, as per NZ Law,  you need to remove the records as per your statement (and section 28 of the act).</p>

<p>Further, by not deleting the information, if you get a request under the <a href="http://www.legislation.govt.nz/act/public/1993/0028/latest/whole.html#whole" rel="nofollow noreferrer">Privacy Act 1993</a> you might find it difficult to comply with the act.</p>

<p>Lastly, you will be in breach of the <a href="http://www.legislation.govt.nz/act/public/1986/0121/latest/DLM96439.html?src=qs" rel="nofollow noreferrer">Fair Trading Act 1986</a> - particularly section 9 which states "No person shall, in trade, engage in conduct that is misleading or deceptive or is likely to mislead or deceive." and section 11 which reads "No person shall, in trade, engage in conduct that is liable to mislead the public as to the nature, characteristics, suitability for a purpose, or quantity of services.".</p>

<p>If the user is European you <strong>must</strong> delete the information - anonymisation  is not sufficient. As the data includes messages there is a good chance that there is sufficient info in them to deanonymise.</p>

<p>Anonymisation is incredibly difficult to do in practice - simply because most of us are in so much publicly available data that algorithms to identify us from metadata alone is relatively straightforward. You have to be aware that I (as an unscrupulous opportunist and criminal) may be <em>looking</em> for a particular person, say a notable politician, ostensibly happily married in online dating sites in order to publicly shame them. If I can access their usage patterns in facebook, twitter etc. steal that metadata and match it to the data I've stolen from you they will stand out from your data set like a sunflower in a sea of daisies.</p>

<p>Under the new California CCPA that came into effect January 1, 2020 you must delete a customer's data on request. If you have customers in a jurisdiction that has such rules, you must comply with those rules. This is why we all have to agree to cookies now, it's a European GDPR rule. </p>

<p>California can fine you if you don't comply with their legislation, and do you really want to test them? Set your policies to comply with the rules of the strictest jurisdiction you do business in.</p>
