2

I cancelled my Zipcar account 5 years ago. Today I tried to re-open it. I created a new account, but it wouldn't allow me to because it said my driver's license was already in use.

I called customer support and the guy at the other end said I would need to re-open my old account. He outlined the steps which involved getting together a bunch of documents and taking photos and emailing them to him. I didn't want to do this because it sounded like too much work and also I don't want Zipcar to have more personal info on me. I figured I could just use a different service like Getaround instead. I asked if they would please just delete my driver's license from their records, but he said they can't do that. Is it legal for them to hold onto my driver's license forever and not give me any way to ask them to delete it?

Improve this question

1 Answer 1

Reset to default
3

Yes. It is legal for them to do so.

Also, they are often required, by their insurers and lawyers, if not as a matter of law, to maintain them for seven years in most cases, so that the information is available if a lawsuit arises from any of their dealings with you (e.g. if they receive notice of a lawsuit involving a Zipcar you were allegedly using or had under your control at the time of an accident, or if there is a class action lawsuit over alleged breach of contract or consumer laws involving their charges to you).

There are virtually no circumstances, with the possible exception of certain credit card account information, when someone has a duty to destroy records maintained about you under U.S. law. In this particular instance, everything on your driver's license is a matter of public record in any case, so your privacy interest is reduced for this reason as well.

Improve this answer
7
  • 1
    I was going to mention the GDPR before you inserted that "under US law" caveat.
    – Michael Seifert
    Mar 11, 2021 at 1:52
  • 1
    @MichaelSeifert I wouldn't have even attempted an answer under EU privacy laws which I recognize are very different from those in the U.S. But this is a California law question.
    – ohwilleke
    Mar 11, 2021 at 1:54
  • 5
    @MichaelSeifert even under GDPR there would almost certainly be an overriding legitimate interest in this case for Zipcar to retain the information for a reasonable period of time (and 7 years in this case seems reasonable) even without consent.
    – user28517
    Mar 11, 2021 at 2:03
  • 1
    @nick012000 Excellent point. It does appear that the CCPA includes a right to be forgotten. As pointed out in Moo's comment, though, Zipcar probably still has a legitimate interest in retaining the OP's information.
    – Michael Seifert
    Mar 11, 2021 at 12:17
  • 1
    @MichaelSeifert Also, the "right to be forgotten" pertains primarily or entirely to information about a person that is available to third-parties, like an internet forum post, not to offline data available only to the parties to the transaction. It prevents information from being publicly displayed, but isn't really intended to address internal, offline, confidential business records (or records that are public elsewhere like a driver's license).
    – ohwilleke
    Mar 11, 2021 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .