0

My website occasionally receives requests from users asking for their account to be deleted. The website itself is a dating site that stores messages between users, personal information they add to their public profile, logs and stats about their usage, etc.

While the site currently lets an admin 'deactivate' a user's account such that it no longer appears publicly, actually deleting the user record and its associated data from the database is problematic. Information we'd be deleting about a user is occasionally necessary and always useful.

One alternative I have toyed with would be to attempt to anonymize the user by clearing all personally identifying pieces of information. Reading about the de-anonymization that occurred with the Netflix dump, it looks as though this could be quite hard to do effectively.

The company is incorporated in New Zealand, the servers are located in the US and users are from all over the world. Here are some relevant points in the Terms and Conditions:

If you wish to terminate your membership you must advise [us] by e-mail. Termination of your membership is effective from our receipt of your e-mail after which time your profile will be removed.

and

[We] will remove records of any conversations, photos or videos of a deactivated user upon their removal from the site. These records will also be removed from any user who may have communicated with the deactivated user.

How must I respond to this request? Does the site need to have functionality that allows us to completely delete all traces of a user? Would attempting to anonymise a user be sufficient? I understand Facebook allow for your account to be 'deleted', but do their really remove all traces? In the worst case scenario and the database was hacked and dumped online, would we be liable for any deanonymization that occurred?

  • 1
    So are you breaking your own TOS by clearly not deleting data when asked? – BlueDogRanch Nov 14 '16 at 22:28
  • @BlueDogRanch They're removed in that they become inaccessible and unavailable on the site. – Andrew Nov 14 '16 at 23:09
  • I see that a number of people have commented concerning New Zealand law, but wish to add that sometimes a foreign country will allow a law suit in that country which may have consequences in your home country. For example, Canadian courts have permitted class action suits to go ahead in Canada where the defendant was a company located outside of Canada AND had TOS that required any law suit to proceed in California, USA. (Douez v. Facebook Inc., 2014 BCSC 953) You may get caught by the law of the other country where the user is, particularly where a common reading of your TOS says you will so – accipter Nov 15 '16 at 3:44
  • Decide on what you do and then tell all users what you are doing when they ask for their account to be deleted, very loudly. – gnasher729 Nov 15 '16 at 8:57
  • Wikimedia (including Wikipedia) does not delete a user account or its contributions. You could inspire yourself from this and their TOS. See: en.wikipedia.org/wiki/… – brclz Nov 15 '16 at 9:57
1

If the user is European you must delete the information - anonymisation is not sufficient. As the data includes messages there is a good chance that there is sufficient info in them to deanonymise.

Anonymisation is incredibly difficult to do in practice - simply because most of us are in so much publicly available data that algorithms to identify us from metadata alone is relatively straightforward. You have to be aware that I (as an unscrupulous opportunist and criminal) may be looking for a particular person, say a notable politician, ostensibly happily married in online dating sites in order to publicly shame them. If I can access their usage patterns in facebook, twitter etc. steal that metadata and match it to the data I've stolen from you they will stand out from your data set like a sunflower in a sea of daisies.

  • The anonymisation process would clear all message content. – Andrew Nov 14 '16 at 22:20
  • @DaleM I agre with your conclusion, but whether users are European are not are irrelevant - New Zealand is not part of the EU, and I don't see how the EU can enforce jurisdiction. Of-course, NZ has good privacy and consumer protection laws as well. – davidgo Nov 14 '16 at 23:34
2

Your terms and conditions are clear that you must delete the data - "[We] will remove records of any conversations, photos or videos of a deactivated user upon their removal from the site. These records will also be removed from any user who may have communicated with the deactivated user."

Your obligations under the Consumer Guarantees Act 1993 are also clear - you can't mislead consumers - thus, as per NZ Law, you need to remove the records as per your statement (and section 28 of the act).

Further, by not deleting the information, if you get a request under the Privacy Act 1993 you might find it difficult to comply with the act.

Lastly, you will be in breach of the Fair Trading Act 1986 - particularly section 9 which states "No person shall, in trade, engage in conduct that is misleading or deceptive or is likely to mislead or deceive." and section 11 which reads "No person shall, in trade, engage in conduct that is liable to mislead the public as to the nature, characteristics, suitability for a purpose, or quantity of services.".

  • Just to be clear, you are stating you will remove all records of the user in your terms and conditions, so this is what you need to do - anonymising or modifying the records is not the same as removing the records. – davidgo Nov 14 '16 at 23:30
  • Thanks a lot for your answer and your comments. You don't think that deleting the text in a message would constitute 'removing' the message/conversation? Even now (and certainly after anonymisation), there is no record of the conversation on the site. Re: Privacy Act, when anonymised, no personally identifying information should would that not be satisfied? The point about the Consumers Guarantee Act and Fair Trading Act is valid as there is ambiguity now you point it out. While the intention was not to mislead, we will look at updating the TOS. – Andrew Nov 14 '16 at 23:48
  • 2
    @Andrew, remove means remove, which means delete: replace with null, wipe off the face of the earth. It doesn't say "remove personally identifying information". – user6726 Nov 14 '16 at 23:57
  • @user6726 Sorry, that comment was in reference to the Privacy Act, which refers to personally identifying information, not the ambiguity in the TOS. I might be wrong, but assuming those ambiguities were fixed, it's my understanding that anonymising this data would not breach the Privacy Act. – Andrew Nov 15 '16 at 2:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.