My website occasionally receives requests from users asking for their account to be deleted. The website itself is a dating site that stores messages between users, personal information they add to their public profile, logs and stats about their usage, etc.
While the site currently lets an admin 'deactivate' a user's account such that it no longer appears publicly, actually deleting the user record and its associated data from the database is problematic. Information we'd be deleting about a user is occasionally necessary and always useful.
One alternative I have toyed with would be to attempt to anonymize the user by clearing all personally identifying pieces of information. Reading about the de-anonymization that occurred with the Netflix dump, it looks as though this could be quite hard to do effectively.
The company is incorporated in New Zealand, the servers are located in the US and users are from all over the world. Here are some relevant points in the Terms and Conditions:
If you wish to terminate your membership you must advise [us] by e-mail. Termination of your membership is effective from our receipt of your e-mail after which time your profile will be removed.
[We] will remove records of any conversations, photos or videos of a deactivated user upon their removal from the site. These records will also be removed from any user who may have communicated with the deactivated user.
How must I respond to this request? Does the site need to have functionality that allows us to completely delete all traces of a user? Would attempting to anonymise a user be sufficient? I understand Facebook allow for your account to be 'deleted', but do their really remove all traces? In the worst case scenario and the database was hacked and dumped online, would we be liable for any deanonymization that occurred?