How to handle account deletion of user with financial information and/or otherwise liability related information

Question

So, I read a post on reddit the other day about a user unhappy with Binance (crypto currency exchange company) for only being able to "disable" his account but not "delete" it.

Binance is used in Europe which means they must abide by the GDPR. Which states that a user may request information deletion.

However, this information is related to financials. Meaning if they delete it and some government comes after them they could be liable. So which takes precedence in this situation?

If they(government entity) prefer you to hold the financial information, couldn't any company argue that they can't delete user information for fear of be liable for.something?

Answer 1

The GDPR will probably not allow a successful demand for erasure in these circumstances. The company does not need to argue "that they can't delete user information for fear of be liable for.something" because GDPR art 17 1(c), 3(b), and 3(e) already make that case for the company.

Lets look at the relevant law.

GDPR Article 17 reads in relevant part:

(1) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(1) (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(1) (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

(1) (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

...

(3) Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

(3) (a) for exercising the right of freedom of expression and information;

(3) (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

...

(3) (e) for the establishment, exercise or defence of legal claims.

Art 17 Par 1 (a) only allows erasure when data are "no longer necessary". But depending on how the purposes were worded by the Controller, they may well still be necessary

Art 17 Par 1 (b) only allows erasure when consent is withdrawn and consent was the legal basis for processing. But a contract with the user is a much more likely basis for processing for a financial service.

Art 17 Par 1 (c) requires erasure if the user objects and there is no "overriding legitimate grounds for the processing" but the needs to maintain financial records of a transaction is probably an "overriding legitimate ground".

In any case par 3 alloys erasure to be refused "for compliance with a legal obligation" or "for the establishment, exercise or defence of legal claims". Financial records may well fall into one or both of these categories, at least as regards transaction data.

In short it is far from clear that the GDPR will require erasure in these circumstances.

Answer 2

couldn't any company argue that they can't delete user information for fear of be liable for.something?

In most contexts, yes. The merit of that argument is premised on article 17(3)(b), (e) of the GDPR for as long as the potential claims have not prescribed.

In the context you outline, the exchange has to comply with regulations for purposes including, but not limited to, fiscal and anti-money laundering matters. The exchange knows or should know that the possibility that authorities may audit the exchange are not far-fetched. That imposes on the exchange the obligation to preserve records in the event that it is audited or investigated.

Additionally, the records might contain material evidence for ongoing, prospective/imminent, or potential litigation. Compliance with a deletion request could equitably forfeit the user's potential claims, but that does not imply that the controller must also waive the possibility of pursuing its own claims that could be proved by means of those records. To defeat the controller's premise, the user would need to prove that the records at issue cannot reasonably involve "the establishment, exercise or defence of legal claims" (article 17(3)(e)).