Private company making it hard to delete customer's personal data

Question

Storyline

A friend of mine opened an account with an online company that sells picture prints. Without her knowing, just after signing in, somehow (she did not understand how; probably through the Apple application Photos), the company came into possession of the photos she had on her computer.

When she realized they were in possession of her photos, she sent an email asking for the account to be closed and her personal data (photos included) to be deleted from their system. It follows a pretty long list of confusing emails at the end of which they agreed to close the account. They did not confirm they would delete the pictures though.

Two months later, she received a promotion email that included her pictures! She sent another email asking to stop promotional emails and also asking to delete the pictures. They answered they can't delete the pictures themselves, but they can reopen the account so that she can delete her pictures herself. She accepted it to reopen the account (which was probably an unfortunate move). Turns out, deleting pictures can only be done one at a time and there are thousands of pictures, which is more than inconvenient! That's at this moment that my friend told me the story.

Extra information

No payment and no banking information has ever been given to this company. Note also, if it matters, that my friend lives in Canada.

Question

I very much suspect she is in right to 1) no receive promotion emails anymore, 2) Have them close the account again and 3) have them delete her pictures. Am I right?

Can you please advise us on an appropriate answer to hopefully convince the company to respect those rights?

Answer 1

I very much suspect she is in right to 1) no receive promotion emails anymore, 2) Have them close the account again and 3) have them delete her pictures.

No, she does not have those rights. She agreed to a legally binding contract when she signed up for the service when she clicked "OK" to open the account. That contract outlines her "rights," as you call them, and they can be very different from what you assume to be ethical and moral bounds to a business relationship. What you imagine to be fair business practices could be generally regarded as fair and normal consumer relations; but that's not necessarily what may be in the contract.

What she agreed to in the Terms of Service (TOS) could be some form of long term licensing of her photos to the service, and that could be why they won't delete the photos and why she can't delete them in bulk. The TOS states the terms of the promo emails she agreed to receive. Read the TOS; everything will be outlined. The company is in no way obligated to make life easy for her or change the contract to appeal to her; she agreed to everything, including downloading all her photos. If she didn't read the TOS and feels they copied all her photos "without her knowing", that's her fault.

It's possible that the company is breaking consumer protection laws with some of their practices, but you'll need to read Canada consumer laws and see if they require ease of use, permanent op-out of emails, etc. I doubt the company would be flagrantly violating consumer law.