On my web app, the only personal information that I ask users for when they sign in is their e-mail address.

The e-mail address is not shown to any other users, but one can check if a user exists with a given e-mail address (by trying to create a new account with the same address, since only one account per address is allowed).

Am I legally required to allow users to delete their account? I am especially interested in European law.

Thank you very much in advance.

  • Can you change the message displayed after new account creation to be more general, like "we've sent an e-mail to your e-mail address at show@the.address; please check your e-mail for further instructions and a confirmation link" and then only show a difference in the text of the e-mail ("welcome" vs. "here's a link to reset your password")? – WBT Jul 18 '16 at 15:12
  • I am sorry, but I don't get what you are talking about. My question has nothing to do with the registration process. – Aspie96 Jul 18 '16 at 15:32
  • The question seems to revolve around a privacy concern, that information regarding who has an account can leak out. I'm suggesting a way to plug that leak so that the only way a person could determine who else has an account would be to hack into either your database or that user's e-mail (or ask the user directly). Also, are you familiar with the case of "Ashley Madison?" – WBT Jul 18 '16 at 15:36
  • Ah, ok, I get what you mean now, thank you very much for specifying. Your suggestion is really nice and I will surely consider it, but it's not my main concearn. The problem is that I don't know if, in general, it is mandatory to allow users to delete their account. I will modify the question to make it clearer. Thank you again. – Aspie96 Jul 18 '16 at 15:58
  • Your question is generally OK; I recognize my suggestion doesn't really address the main legal question. That's why I posted it as a comment instead of an answer. – WBT Jul 18 '16 at 15:59

As of fall 2015, the "International Safe Harbor Privacy Principles" are no longer sufficient in Europe. New regulations, written by the Article 29 Data Protection Working Party, came out in spring 2016 and information on this group, including regulatory text, can be found here.

On their site, the page "Protecting your data: your rights" states that users can ask several things of "persons or entities which collect your personal data" including:

  • You have the right to ask for the deletion, blocking or erasing of the data.

On a page listing obligations of those who collect personal data, it says:

  • Data controllers must ensure that data subjects can rectify, remove or block incorrect data about themselves.
  • Data that identifies individuals (personal data) must not be kept any longer than strictly necessary.

In the documents section, their January 2016 Fact Sheet titled "How does the data protection reform strengthen citizens' rights?" states:

If you no longer want your personal data to be processed, and there is no legitimate reason for a company to keep it, the data shall be deleted.

For the reasons listed above, I conclude that in most cases, you should accept and comply with user requests for account deletion. There are likely exceptions, such as if you and the user have some active dispute and the data stored in the account would be evidence in resolving that dispute, but hopefully that is a small minority of account deletion requests.

  • I haven't thought of that problem before, but how does it cope with backup copies? Generally, it is a good idea not to edit backup copies. If a user deletes its account, should I also delete it in backup copies of my DB? – Aspie96 Jul 20 '16 at 10:15
  • I believe the regulation applies to copies as well as the live database. – WBT Jul 20 '16 at 13:03

Well, WBT's answer answers the question with one semi-exception (not necessarily applicable in your case). In particular, this: "and there is no legitimate reason for a company to keep it". There are many online forums where people post stuff is discussion form, and it could be highly disruptive to the integrity of the forum if posts were suddenly deleted (responses would be non-sequitur). Preserving the structure of a discussion is a legitimate reason to keep those posts. Now theoretically it might be possible to delete the underlying personal data (the person's email address), but generally speaking this is not something that can be controlled by a normal site administrator. It is therefore reasonable to not delete such data, since it is typically not possible to do without disrupting the site or imposing a huge burden on the site (imaging having to manually edit all of the posts on Stackexchange to eliminate any reference to an individual).

Also note that many people understand "delete my account" to include "delete anything that I have posted", not just "delete my email address".

  • StackExchange has scripts for that, at least for post metadata. See information about it in the Help Center or on Meta Stack Exchange. – WBT Jul 18 '16 at 17:07
  • This is a bit confusing. In my case, we are creating the application from scratch, from down to bottom. Each user has a username (which is public information, according to our privacy policy) and can upload files (which do not contain personal data). In my case, the reason to keep the e-mail address is that it provides more consistency in the database. Would this be a "legitimate reason" (we are not a company, but I think the same principle applies). – Aspie96 Jul 19 '16 at 10:43
  • Well, if you have control... in the database you could change any instance of the person-identifier with a unique integer. That provides the same function as an email address, and with only minor (?) programming inconvenience to you, so in the face of an alternative, keeping the personal data would not actually be necessary. – user6726 Jul 19 '16 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.