1

English

I am located in Germany.

The issue: GoDaddy refuses to delete parts of my personal data

A few weeks ago I opened an account with the GoDaddy domain provider. The aim was to register a few domains at GoDaddy. But for various reasons I then did it with a different provider. I did not have any business relationships with GoDaddy, I did not receive any paid services from GoDaddy. It is just about accidentally opening an account at GoDaddy.

So I wrote a formal request to GoDaddy to delete my personal data, according to the rules of the General Data Protection Regulation (GDPR).

I will spare you the long e-mail process. Long story short: GoDaddy only agrees to immediately delete an unknown part of my personal data, but GoDaddy wants to keep another unknown part of my personal data for an unknown time.

Further, GoDaddy does not want to give me the information ...

  • what part of my personal data GoDaddy wants to keep, and
  • how long GoDaddy wants to keep this part of my personal data.

GoDaddy claims to be „fully compliant with GDPR“

Notice, GoDaddy claims to be „fully compliant with GDPR“, see this excerpt from GoDaddy's FAQ, archived link (italics by me):

What is GoDaddy’s privacy/data policy?

GoDaddy is fully compliant with GDPR. Here you can read GoDaddy’s privacy policy, including information on what data we store and what it is used for.

In addition to this, all GoDaddy staff members are trained on data protection issues.

The GDPR confirms that I can request deletion of my personal data from GoDaddy without undue delay

Lets see what Article 17 of the GDPR says (italics by me):

(1) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(...)

Resulting questions

Since I want to delete my GoDaddy account, and since I have or had no open business relationships with GoDaddy, I don't see what GoDaddy wants with my personal data. My personal data can be deleted without undue delay.

This leads to the questions:

  • Can GoDaddy delay the deletion of parts of my personal data?
  • Can GoDaddy refuse to tell me which parts of my personal data GoDaddy will not delete?
  • Can GoDaddy refuse to tell me how long GoDaddy will not delete these parts of my personal data?

I can upload my e-mail communication with GoDaddy to a GitHub Gist, if anyone is interested.

I will inform GoDaddy about these questions here, so that GoDaddy can join the discussion if GoDaddy so wishes.

3
  • 2
    You seem to assume that "immediate deletion" is the same thing as deletion "without undue delay." I think you're mistaken, though we could be dealing with a gap in the translation.
    – bdb484
    Commented Mar 14, 2021 at 20:49
  • Thank you, @bdb484 I improved the question accordingly (accidentally I was not logged in). I indeed just overlooked this. Commented Mar 14, 2021 at 21:34
  • you can not ask questions partially or fully on german here.
    – Trish
    Commented Jul 19 at 10:29

1 Answer 1

2

The situation as described does seem borderline non-compliant, but it will depend on the details.

The GDPR's right to erasure has many conditions and exceptions. It is not a blanket right to get anything expunged. The right to erasure should be understood as an elaboration of the data minimization and storage limitation principles, that as little data as possible should be collected/stored/processed.

The issues that you raise are less about erasure (which might have been validly denied), and more about a lack of transparency. Fortunately for you, the GDPR's transparency/information rights are much stronger than the right to erasure.

Ultimately, if you are not satisfied with a data controller's response, you can lodge a complaint with your supervisory authority. In Germany, a list of state authorities can be found here.

On to your concrete questions.

Can the data controller delay the deletion of parts of my personal data?

It is generally legitimate for a controller to deny erasure for some parts of the personal data undergoing processing, either if none of the cases under Art 17(1) apply or any exception in Art 17(3) applies.

You have highlighted the requirement that erasure shall be performed without “undue delay” (unverzüglich). This requirement is clearly distinct from the Art 12(3) deadline to respond to data subject requests “without undue delay and in any event within one month”. Whether a delay in executing a granted erasure request would be undue would depend on the individual circumstances. For example, I would expect that substantial delays could be permissible e.g. when the data controller uses an immutable backup strategy where it might take multiple months until the old backups with the personal data are rotated.

However, there seems to be no delayed erasure in this scenario. Instead, your request to erasure was partially denied, with some part of the data being retained for some unspecified period.

Can the data controller refuse to tell me which parts of my personal data they will not delete?

Not really. If a data controller refuses a request, then per Art 12(4) they shall “inform the data subject without delay […] of the reasons for not taking action”. For example, a reason for refusing erasure could be an exception from Art 17(3). For a partially denied request, it would of course be appropriate to indicate for which part it was denied.

In any case, you can invoke your right to information and access to discover which data is stored for what reason and for how long.

  • Per the Art 13(1)(c) right to information, you must be told about the purposes and legal basis of processing. Usually, this is done via a privacy notice posted on a website.

  • Per Art 15, you can request access to your personal data. Per Art 15(1)(b) the response must inform you about the categories of personal data concerned. Access to the data can only be denied if the access would “adversely affect the rights and freedoms of others”.

While data controllers should really at least explain the “categories of personal data concerned” as part of their privacy notices, you could wait until erasure has been carried out and then invoke your right to access to discover this information.

Can the data controller refuse to tell me how long they will not delete these parts of my personal data?

The same line of reasoning as in the previous part applies. If no fixed retention period exists you can't be told it, but otherwise you are entitled to know for how long your data will be kept. If it is not possible to tell you a retention period, you must be informed about the criteria used to determine that period.

  • Per Art 13(2)(a) you must have been given this information at the time when your data was first collected, i.e. typically through a privacy notice.
  • Per Art 15(1)(d) this information should also be included in a response to a access request.
5
  • Thank you for this answer. Can you elaborate, what you mean with you could wait until erasure has been carried out and then invoke your right to access to discover this information? How can I request which of my private data they save, if they deleted it already? Commented Mar 14, 2021 at 21:38
  • Indeed, I can live with a delay until they delete my personal data, but they are not even clear if they will delete my data at all (at least not until I had nagged a lot). On the page in the GoDaddy settings, where a user can delete his account, GoDaddy writes: „Note: Certain data may be retained in accordance with our data retention guidelines“ (screenshot). When I asked them about these guidelines they refused to communicate them. So it can mean: "two weeks" or "forever"... Commented Mar 14, 2021 at 22:31
  • 1
    @NilsLindemann They are claiming legitimate interests and legal obligations for keeping some data. In my opinion they should list more concrete categories of what they will keep, but there is no clear precedent or guidance on this matter. I personally think providing information on the granularity of an Art 30 Records of Processing document is appropriate. My point with the access request was that you can later make such a request to discover what they are still storing at that time. And as explained, the response should also explain the retention periods.
    – amon
    Commented Mar 15, 2021 at 11:27
  • I will proceed as you suggested and send them a letter after a while, requesting access to my data according to Art. 15 GDPR. See also this other question of me regarding the procedure. Commented Mar 15, 2021 at 20:49
  • Don't forget GoDaddy may have operational and legal reasons to retain certain details which contain personal details, e.g. sign in logs, whislt still complying with the GDPR.
    – deep64blue
    Commented Jun 30, 2023 at 21:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .