10

I asked this question to Facebook:

I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with other Facebook users that I don't want them to be able to see/read anymore.

If this is currently possible, or will be possible in the future, how can I apply this action also to messages I have already deleted from my side in the past?

And they replied this:

Messenger works like texting (SMS) and other mobile messaging apps to let you reach people instantly on their phones. When you send a message on Messenger a copy will be saved to your device. Only you and the people you’re in a conversation with can see your messages.

Deleting a message permanently removes it from your inbox and your copy is removed from our servers. Keep in mind that deleting a message or conversation from your inbox won't delete it from your another person's inbox. As with messages sent via text message or by email, it isn't possible to delete sent or received messages from another person's inbox.

Since I don't agree with this answer, I replied:

While I understand what you mean regarding Messenger working like texting (SMS), there is a difference in that SMS messages do not stay saved on the servers permanently.

Even with Whatsapp, as far as I know, messages are deleted from the servers once they reach the recipient's device. This seems more like texting (SMS).

So, regarding Messenger, I would like to have a way to delete messages from Facebook's servers (including those I deleted so far), in both my side and recipient's side, even if a copy stays on recipients' devices.

With a final reply from Facebook:

As previously mentioned deleting a message permanently removes it from your inbox and your copy is removed from our servers. However, deleting a message or conversation from your inbox won't delete it from your another person's inbox. As with messages sent via text message or by email, it isn't possible to delete sent or received messages from another person's inbox even if you delete your account.

Is this being GDPR compliant?

I'm sure they are aware that private messages can have a lot of PII data, such as photos, addresses, private information that can easily identify an individual, etc... (or even my name, if they keep it attached to the message threads)

If I decide to delete my account, apparently all the private messages I sent to others will never be deleted from Facebook servers, unless the recipients have deleted from their side.

I don't see this as being compliant to the Art. 17 GDPR - Right to erasure.
Am I correct?

  • Switch to Telegram. They allow you to delete any message that you've sent, no matter how long in the past. – JonathanReez Jun 5 at 2:52
  • @JonathanReez - my problem isn't where do I switch to. I already stopped using Facebook Messenger completely. My problem is with the messages I want completely gone from Facebook. – Nuno Jun 5 at 9:39
  • Sure, then you are free to sue Facebook. I wish you good luck, it could be a great case. – JonathanReez Jun 5 at 15:41
7

Art. 17 GDPR Right to erasure (‘right to be forgotten’)

  1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

Assuming private messages contain personal data, if at least one of the following points (a..f) applies, it would have to be deleted.

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

The original main purpose was probably Article 6(1)(b) (performance of a contract). If you delete your account, that would no longer apply. However, for the receiver of the private message, Article 6(1)(f) (legitimate interests pursued by a third party) would apply. The receiver might still want to read that message. So there is still a purpose to process this data. So point (a) does not apply.

(Note that a Facebook private message can be considered a hosted version of SMS messages. A receiver does not expect SMS messages to be automatically deleted after they have reached the recipient's device. A receiver expects full control of the storage of SMS messages. I think a receiver expects the same for messages on facebook.)

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

Data processing was not based on consent, so point (b) does not apply.

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

Article 21(1) allows you to object to processing based on Article 6(1)(f), unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject. While I think processing is based on Article 6(1)(f), I also think there are legitimate grounds to refuse your objection. As explained before, the receiver might still want to read that message. The receiver was able before to read your message, so one can assume he/she has already knowledge of the personal data in the message. As it is a private message, no one else will be able to read that message. (At least Facebook will not allow it). So if the message is not deleted, the privacy implications for you are low. That's why I think the interests of the receiver will prevail. However, in the end, a judge will be the only person which can make such a consideration. So you would have to got to court to get a final decision about this.

Article 21(2) is for direct marketing, that does not apply to this situation. So I think point (c) does also not apply.

(d) the personal data have been unlawfully processed;

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

These points do not apply.

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

This data processing was not based on consent, so even if you are a child below the age of 16 years, point (f) does not apply.

Article 17(2) and Article 17(3) wont help you either. So in my opinion Facebook is right in this case.

  • "The receiver was able before to read your message, so one can assume he/she has already knowledge of the personal data in the message" - ok, but what if there is a data breach in the future, where all private messages can be read? I closed business with Facebook, so I want my data to be deleted and not to be in risk of data breach. Also, using that point, Facebook keeps a list of viewers of a post on a Group. If I delete that post, should Facebook keep it visible to the people who have viewed it? After all, they have already viewed it. – Nuno Aug 15 '18 at 21:16
  • "Facebook private message can be considered a hosted version of SMS messages" - SMS messages aren't stored on servers forever, like Facebook does. If I send an SMS to someone, it only stays on the recipient's phone. With Facebook, someone could hack the recipient's Facebook account and then get access to ALL our private chats. // "the receiver might still want to read that message" - not sure if this should be a reason. I might want to have it deleted. I might also want to read other people's posts, who they deleted from their profile. – Nuno Aug 15 '18 at 21:17
  • 2
    A future data breach or someone being hacked would also be a problem if you don't delete your account. The question is whether something like that is likely to happen in the future, of whether it is just a theoretical issue. You would have to go to a court and prove your point. In the end, only the European Court of Justice can explain how the GDPR has to be interpreted. – wimh Aug 15 '18 at 22:11
  • very likely to happen at any time - look at what happened in the past few weeks :) - newsroom.fb.com/news/2018/09/security-update - I don't go with "probabilities". Things do happen, and I'm not using Facebook Messenger anymore. However, I want my data deleted as soon as I delete my Facebook account, and they do not seem to be respecting that. – Nuno Sep 29 '18 at 8:35
0

I think the answer is provided here, in the introduction of the GDPR law:

(18) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

So I think it depends on what Facebook does with the data on their servers, technically. If when you ask them to delete the personal data they actually delete it from all their servers, then it's ok. If the data only remains on the recipient's device and Facebook isn't able to access it anymore, then it's ok. The reason is that it would be data only owned by the recipients, and so it would be part of a "personal activity" unrelated to any professional or commercial activity. You would have to ask the recipient to delete the message you sent them, but the recipient won't have to comply with the GDPR if they are simply a natural person (not a company, etc.)

However if the data somehow remains on Facebook's servers, anywhere, if you deny your consent and ask them explicitly to delete the data, then they must delete it to comply with the GDPR.

  • The messages definitely stay on FB servers. I mentioned to FB that I wouldn't mind if the messages just stayed on recipient's device, like with Whatsapp, and then they gave me the last reply I quoted in my Question above. Only my side of the copy is deleted. – Nuno Sep 18 '18 at 12:33
  • @Nuno, then that it's definitely not allowed by the GDPR. They can't say that the deletion of your personal data depends on whether another user decides to delete it. The controller (Facebook) must delete it. – reed Sep 18 '18 at 13:14
  • 1
    @Nuno that's a dangerous argument, as it then obliges webmail providers to remove copies of emails you have sent to other parties... I don't think that is ever to happen or even intended to be the case – user4210 Jan 17 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.