Can the GoDaddy Provider refuse to immediately delete parts of my personal data?

Question

English

I am located in Germany.

The issue: GoDaddy refuses to delete parts of my personal data

A few weeks ago I opened an account with the GoDaddy domain provider. The aim was to register a few domains at GoDaddy. But for various reasons I then did it with a different provider. I did not have any business relationships with GoDaddy, I did not receive any paid services from GoDaddy. It is just about accidentally opening an account at GoDaddy.

So I wrote a formal request to GoDaddy to delete my personal data, according to the rules of the General Data Protection Regulation (GDPR).

I will spare you the long e-mail process. Long story short: GoDaddy only agrees to immediately delete an unknown part of my personal data, but GoDaddy wants to keep another unknown part of my personal data for an unknown time.

Further, GoDaddy does not want to give me the information ...

• what part of my personal data GoDaddy wants to keep, and
• how long GoDaddy wants to keep this part of my personal data.

GoDaddy claims to be „fully compliant with GDPR“

Notice, GoDaddy claims to be „fully compliant with GDPR“, see this excerpt from GoDaddy's FAQ, archived link (italics by me):

What is GoDaddy’s privacy/data policy?

GoDaddy is fully compliant with GDPR. Here you can read GoDaddy’s privacy policy, including information on what data we store and what it is used for.

In addition to this, all GoDaddy staff members are trained on data protection issues.

The GDPR confirms that I can request deletion of my personal data from GoDaddy without undue delay

Lets see what Article 17 of the GDPR says (italics by me):

(1) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(...)

Resulting questions

Since I want to delete my GoDaddy account, and since I have or had no open business relationships with GoDaddy, I don't see what GoDaddy wants with my personal data. My personal data can be deleted without undue delay.

This leads to the questions:

• Can GoDaddy delay the deletion of parts of my personal data?
• Can GoDaddy refuse to tell me which parts of my personal data GoDaddy will not delete?
• Can GoDaddy refuse to tell me how long GoDaddy will not delete these parts of my personal data?

I can upload my e-mail communication with GoDaddy to a GitHub Gist, if anyone is interested.

I will inform GoDaddy about these questions here, so that GoDaddy can join the discussion if GoDaddy so wishes.

---

Deutsch

Ich lebe in Deutschland.

Das Problem: GoDaddy verweigert die Löschung von Teilen meiner persönlichen Daten

Vor ein paar Wochen habe ich bei dem Domain-Provider GoDaddy ein Konto eröffnet. Das Ziel war, ein paar Domains bei GoDaddy zu registrieren. Aus verschiedenen Gründen habe ich es dann aber bei einem anderen Provider gemacht. Ich habe keine Geschäftsbeziehungen mit GoDaddy gehabt, Ich habe keine bezahlten Dienstleistungen von GoDaddy empfangen. Es handelt sich nur um das versehentliche Eröffnen eines Kontos bei GoDaddy.

Ich schrieb daher eine formalisierte Anfrage an GoDaddy, meine persönlichen Daten zu löschen, entsprechend den Regeln der Datenschutz-Grundverordnung (DSGVO).

Den langen E-Mail-Verlauf erspare ich ihnen. Lange Rede, kurzer Sinn: GoDaddy willigt nur ein, einen mir unbekannten Teil meiner persönlichen Daten sofort zu löschen, einen anderen, mir unbekannten Teil meiner persönlichen Daten will GoDaddy aber für eine unbekannte Zeit behalten.

GoDaddy will mir ferner keine Auskunft darüber geben ...

• welchen Teil meiner persönlichen Daten GoDaddy behalten will, und
• wie lange GoDaddy diesen Teil meiner persönlichen Daten behalten will.

GoDaddy behauptet, „sich vollumfänglich an die DSGVO“ zu halten

Beachten Sie, GoDaddy behauptet, „sich vollumfänglich an die DSGVO“ zu halten, siehe dieser Ausschnitt aus GoDaddy's FAQ, archivierter Link (kursiver Text von mir):

What is GoDaddy’s privacy/data policy?

GoDaddy is fully compliant with GDPR. Here you can read GoDaddy’s privacy policy, including information on what data we store and what it is used for.

In addition to this, all GoDaddy staff members are trained on data protection issues.

Die DSGVO bestätigt, dass ich die unverzügliche Löschung meiner persönlichen Daten von GoDaddy verlangen kann

Schauen wir uns an, was Artikel 17 der DSGVO sagt (kursiver Text von mir):

(1) Die betroffene Person hat das Recht, von dem Verantwortlichen zu verlangen, dass sie betreffende personenbezogene Daten unverzüglich gelöscht werden, und der Verantwortliche ist verpflichtet, personenbezogene Daten unverzüglich zu löschen, sofern einer der folgenden Gründe zutrifft:

a) Die personenbezogenen Daten sind für die Zwecke, für die sie erhoben oder auf sonstige Weise verarbeitet wurden, nicht mehr notwendig.

(...)

Resultierende Fragen

Da ich meinen Account bei GoDaddy löschen möchte, und da ich keine offenen Geschäftsbeziehungen mit GoDaddy habe oder hatte, sehe ich nicht was GoDaddy mit meinen persönlichen Daten noch will. Meine persönlichen Daten können unverzüglich gelöscht werden.

Das führt zu den Fragen:

• Darf GoDaddy die Löschung von Teilen meiner persönlichen Daten verzögern?
• Kann GoDaddy mir die Auskunft verweigern, welche Teile meiner persönlichen Daten GoDaddy nicht unverzüglich löschen wird?
• Kann GoDaddy mir die Auskunft verweigern, wie lange GoDaddy diese Teile meiner persönlichen Daten nicht löschen wird?

Ich kann meine E-Mail-Kommunikation mit GoDaddy auf ein GitHub Gist hochladen, falls jemand interessiert ist.

Ich werde GoDaddy über diese Fragen hier informieren, damit GoDaddy sich an der Diskussion beteiligen kann, wenn GoDaddy das wünscht.

Answer 1

The situation as described does seem borderline non-compliant, but it will depend on the details.

The GDPR's right to erasure has many conditions and exceptions. It is not a blanket right to get anything expunged. The right to erasure should be understood as an elaboration of the data minimization and storage limitation principles, that as little data as possible should be collected/stored/processed.

The issues that you raise are less about erasure (which might have been validly denied), and more about a lack of transparency. Fortunately for you, the GDPR's transparency/information rights are much stronger than the right to erasure.

Ultimately, if you are not satisfied with a data controller's response, you can lodge a complaint with your supervisory authority. In Germany, a list of state authorities can be found here.

On to your concrete questions.

Can the data controller delay the deletion of parts of my personal data?

It is generally legitimate for a controller to deny erasure for some parts of the personal data undergoing processing, either if none of the cases under Art 17(1) apply or any exception in Art 17(3) applies.

You have highlighted the requirement that erasure shall be performed without “undue delay” (unverzüglich). This requirement is clearly distinct from the Art 12(3) deadline to respond to data subject requests “without undue delay and in any event within one month”. Whether a delay in executing a granted erasure request would be undue would depend on the individual circumstances. For example, I would expect that substantial delays could be permissible e.g. when the data controller uses an immutable backup strategy where it might take multiple months until the old backups with the personal data are rotated.

However, there seems to be no delayed erasure in this scenario. Instead, your request to erasure was partially denied, with some part of the data being retained for some unspecified period.

Can the data controller refuse to tell me which parts of my personal data they will not delete?

Not really. If a data controller refuses a request, then per Art 12(4) they shall “inform the data subject without delay […] of the reasons for not taking action”. For example, a reason for refusing erasure could be an exception from Art 17(3). For a partially denied request, it would of course be appropriate to indicate for which part it was denied.

In any case, you can invoke your right to information and access to discover which data is stored for what reason and for how long.

• Per the Art 13(1)(c) right to information, you must be told about the purposes and legal basis of processing. Usually, this is done via a privacy notice posted on a website.

• Per Art 15, you can request access to your personal data. Per Art 15(1)(b) the response must inform you about the categories of personal data concerned. Access to the data can only be denied if the access would “adversely affect the rights and freedoms of others”.

While data controllers should really at least explain the “categories of personal data concerned” as part of their privacy notices, you could wait until erasure has been carried out and then invoke your right to access to discover this information.

Can the data controller refuse to tell me how long they will not delete these parts of my personal data?

The same line of reasoning as in the previous part applies. If no fixed retention period exists you can't be told it, but otherwise you are entitled to know for how long your data will be kept. If it is not possible to tell you a retention period, you must be informed about the criteria used to determine that period.

• Per Art 13(2)(a) you must have been given this information at the time when your data was first collected, i.e. typically through a privacy notice.
• Per Art 15(1)(d) this information should also be included in a response to a access request.