Keeping a user's agreement to service terms after the account was closed?

Question

When new users sign up on my software as a service platform they have to agree to the terms and conditions. That they did so is stored in a database record along with the revision of the legal documents that are in effect at the time of the sign up.

When a user requests the deletion of the account I obviously should delete all data I have about the user.

However, my gut feeling says that I should at least keep the email address – this is how users identify themselves on my platform – as well as the database record about the agreement to the terms and conditions. Just in case I get sued.

This means I would keep some personal data of the user after the account was closed. Do you know any restrictions in Germany – where my business is located – or from any other jurisdiction that don't allow me to do so?

Answer 1

There is a fundamental conflict here - on the one hand, privacy laws (Datenschutz) demand that all personal data should be deleted as soon as possible. On the other hand, your business relationship to your customers/users requires some data, and there are also laws mandating minimum retention periods for some types of data (e.g. tax-relevant data).

The Bundesdatenschutzgesetz (BDSG) contains rules on deletion of data in § 35 - Berichtigung, Löschung und Sperrung von Daten. Short version:

• You need to delete data once you no longer need it for the purpose it was collected for.
• You may also have to delete (or, in some cases, at least block access) to data if you cannot prove it is correct.

---

In your case:

If there is a reasonable possibility of a user suing you after requesting the deletion of their account, you may retain contractually relevant information.

You should inform the user which information you retain after account deletion (and why). Also, you may have to delete the information later, once the user can no longer sue you.

For details, I would strongly advise you to invest some money into advice from a qualified lawyer (or some other qualified organisation, such as Industrie- und Handelskammer). Privacy law is very complex, and the exact rules depend on many details.