Imagine an on-line service which offers 1 month of free trial for new users. Can I perpetually:
- register for the trial, use it for a month
- request my account deleted and my data forgotten
- repeat ?
Add a comment
|
3 Answers
Under GDPR, can I request to be forgotten and re-register for a trail?
No (unless they are stupid.)
The "right to be forgotten" does not mean they have to delete your data. They can keep personal data about if they have "legitimate interests" to keep these data. Stopping clients from abusing their "free trial" system is a legitimate interest.
Definitely not legal advice and please consult an attorney before making any moves w/r/t GDPR (or anything else, really!).
Under the GDPR, the "right to erasure" applies in the following circumstances:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f)the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
However, those points do not apply when the processing in question is necessary:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e) for the establishment, exercise or defence of legal claims.
If no exceptions apply and one of the above circumstances exists, the
data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay
Therefore, the statement that
The "right to be forgotten" does not mean they have to delete your data
is inaccurate.
According to the United Kingdom's Information Commissioner's Office, there are two other ways a request to delete information may be denied. It may be denied if the request is
manifestly unfounded or excessive, taking into account whether the request is repetitive in nature.
If that is the case, the request may be refused or a "reasonable fee" to deal with the request may be requested.
The bottom line is the company
could argue that its legitimate interests override your request; or
could argue that the data is still being used to accomplish the purpose it was originally collected or processed for
You should be able to determine this when you provide the information, though, because
[i]f Controllers use Legitimate Interests as their lawful basis of data processing, then they must ensure that the individuals are told that they intend to process their data. They must also inform them of the Legitimate Interests they have stipulated as the basis of the processing, and they are also obliged to inform them of their right to object to the processing.
However, companies are obligated to only collect and process information that is needed to accomplish the ends for which the data is acquired. Thus, you may be able to request that certain parts of your information be deleted. For example, the company may need your name and email address to prevent you from achieving your goal of lifetime freebies; however, perhaps they would not need your home address for those purposes. You'd likely be able to successfully have that part of your data removed nonetheless, because there is also an obligation to get rid of personal information within a reasonable time after which the data is no longer needed.
Alternatively, you may get away with it a time or two, but it is conceivable that after that, assuming they catch on, they would be able to establish that your request for erasure is "manifestly unfounded or excessive, taking into account whether the request is repetitive in nature."
Finally, and this is simply conjecture on my part and I think it would be an interesting scenario, perhaps the company would be required to delete your data, but your attempt to take advantage of their free trial services would create the legitimate interest the company could rely on or perhaps it could create a new purpose for the keeping of that information that had not existed already.
At the end of the day, you're probably not going to get away with the free trial scheme. However, I wanted to make sure you had a full answer and one that considered the various aspects of this issue.
-
1It seems to me that point e would allow the retention of identifying information for the purpose of defending against a potential future claim, but more importantly, it seems that the right to erasure doesn't exist here because none of the grounds in 17(1) applies. That is, retention of data for this purpose falls under 6(1)(f), not 6(1)(a).– phoogMay 26, 2018 at 13:37
-
It may indeed seem that way to you, but that's not the way it is. Think about that statement. Do you think they passed this law that is supposed to set the global standard for data protection and following years of anticipation and preparation, the authorities are just blindsided with a loophole that lets virtually every business keep everyone's info on the basis of "Well, they may sue me."– A.fm.May 26, 2018 at 14:40
-
If common sense isn't enough, the Guidelines on Art. 49 of Reg 2016/679, adopted as of 2/6/18. While Art. 49 deals w/transfers, not processing, it uses nearly exactly the same points & language. It expressly states that "[t]he derogation cannot be used to justify the transfer of personal data on the grounds of the mere possibility that legal proceedings or formal procedures may be brought in the future." Also, the "necessity test" "requires a close and substantial connection between the data ... and the specific establishment, exercise or defense of the legal claim in question.– A.fm.May 26, 2018 at 15:02
-
-
At least three grounds in 17(1) apply. And you don't know whether data retention for this purpose falls under one or the other, unless you have read the company's privacy policy or work there. Although legit interests would be preferable to consent as a basis for processing data, it also is tougher to uphold than consent.– A.fm.May 26, 2018 at 15:37
Even if you do have the right to have your data deleted, that doesn’t mean you can get away with your plan. They can keep a hash of the information you provided, which isn’t personal data since it can’t be linked to you, but if you try to open a new account with the same details they can hash it again and see that the hash already exists.
