As the title suggests, if you delete your account on social media/dating websites and there are personal/private chat messages there.

Under GDPR, would these have to be deleted by the controller?

So for instance, if a site has a 30 day ‘cooling off’ period when you delete your account in order to retrieve your account, should the controller also delete the messages after the 30days from their servers, to the extent they can’t be retrieved/looked at by them?

Or would they still be retained due to the ‘recipient’ still having them?

  • does this help law.stackexchange.com/questions/30951/…
    – Lag
    Aug 5 '20 at 10:03
  • I’ve read through it and couldn’t quite understand it. So want a ‘kind of’ definite answer.
    – Malfoy123
    Aug 5 '20 at 10:09
  • Basically, if they only delete one side of the conversation, would the account be anonymised to the point the messages couldn’t be linked back to a certain account etc?
    – Malfoy123
    Aug 5 '20 at 10:10
  • You arent going to get a definite answer because this hasnt been tested in court yet and the GDPR itself doesnt explicitly cover all the details you want covered. Thats the problem with the GDPR, it sets broad requirements and the intention is to let case law fill in the details.
    – user28517
    Aug 5 '20 at 19:56
  • 1
    The answer in the general case is "it depends". In wimh's answer to the related question they discussed a variety of considerations. It's likely the host relies on a lawful basis and behaves such that they are not obliged to delete the messages. The recipient may have an interest in the messages being kept until the recipient deletes them. I imagine the host would anonymise the sender's messages such that the host can no longer relate them to a person it can identify. The messages will be associated with account ID 123 but the host no longer knows who is the person represented by ID 123.
    – Lag
    Aug 6 '20 at 7:21

Browse other questions tagged or ask your own question.