3

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted?

Or if the user can buy without having an account on the website, but just by specifying their email every time they purchase something, should the entire record be deleted or just clear the personal data (email) in the record?

Improve this question

1 Answer 1

Reset to default
4

This will depend partly on what you use the e-commerce website for. If it is simply a point-of-sales and your accounting records are kept elsewhere, then it may be possible to delete their account including associated orders and payments, though you should check that the software doesn't simply update the record by setting the value for a column named deleted or del for short to 1 instead of 0 to identify deleted records, but instead actually deletes the record from the database. You should consider how you will refund a customer if required after doing so!! (i.e. perhaps you acknowledge the request but keep the information for at least as long as the customer is eligible for a refund, and then delete it).

If the system is also used for accounting records, then if a customer/user wishes to assert their right to be forgotten, it is likely you'll need to disable the account and apply some kind of pseudonymisation (essentially replacing personal identifiers such as name, email address, date-of-birth, with dummy/null data), in order to preserve the integrity of your financial records.

For example, in the UK, there is a statutory obligation on companies to retain financial records for at 7 years. In cases where data cannot be immediately erased due to other legitimate reasons for which it must be kept, once those retention periods expire the data must be erased.

You'll need to keep a record of anyone that requests to be forgotten, and remember to follow-up to complete erasure at the appropriate dates if it can't be done immediately, and when the data is destroyed the user needs to be informed.

Improve this answer
4
  • the account deletion will work automatically, from "my profile", just like on this site, you can go to your profile and find the delete button, at the end they show this: stackoverflow.com/users/delete/completed (opens only if you're logged out), so I guess there's no need to keep record of who deleted their account, because the whole idea was to remove all of their data
    – Omu
    Mar 7, 2018 at 20:07
  • 1
    Its only if there have been financial transactions that might complicate this I think. I don't pay to use stackexchange so would expect a straightforward erasure of all data, but with an e-commerce site you'd need to keep records of who bought what when for how much to complete your statutory accounts and ensure you have records for the statutory retention period in case you're audited. In this case you put a 'restriction on processing' for that customer to ensure no marketing emails get sent etc, the record is basically archived but not physically erased from disk until the appropriate time.
    – richhallstoke
    Mar 8, 2018 at 12:32
  • There are other legitimate reasons for retaining data; for example, you may need to contact purchasers of a product in the event of a safety recall. So long as you write this into your retention policy and only use the data for the stated purposes then you're probably OK.
    – Michael Kay
    Jun 26, 2019 at 14:23
  • Quite right Michael, there are tons of different legitimate reasons like this where it depends entirely on the context. I didn't think it was practical to try and give a list, but that's a really good example you gave.
    – richhallstoke
    Jun 27, 2019 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .