A city in Finland asked me to delete all data for everyone whose login uses a certain domain. The domain contains "edu" in it and "oppilas" (which translates to "student"), and my website doesn't have data that anyone is going to mind losing, so I have already deleted that data, however, I have some concerns about what to do in the future if the decision is less easy:
- I'm a little worried that I shouldn't allow certain domains to be used as logins in the first place, especially ones that might be school related
- I'd like to have some idea for future reference if there's any case where the GDPR would require me to comply with such a request
- I want to figure out the right way to reply to emails like this one
- Is deleting the data actually more of a legal liability than not deleting it in some cases? (People shouldn't be able to delete other people's accounts.)
I searched quite a bit but couldn't find anyone discussing the possibility of any of these things:
- an organization asking for the deletion of personal data
- requests to delete data for more than one person
- the GDPR saying anything about school-related domain names
What makes this request seem wrong is probably pretty obvious, judging from the very straightforward wording of the GDPR:
- an individual can ask for deletion of their own data, and a guardian acting on a specific child's behalf can ask for data deletion, but there is no mention of any other situation
- you can (should?) ask for a reasonable amount of identification for the individuals, but in a case like this, it would require the city to identify all logins and prove that they are acting on behalf of all these people, which would, itself seem like a breach of privacy (unless they have a specific list for the ones visiting my website)
This seems like a pretty blatant misuse of the GDPR even if it is well-intentioned, and I'm wondering if I should notify some authority about it. I wouldn't bother if it were a teacher or some other small group, but it's the government of a city with a population of tens of thousands of people, and it seems like they're just blasting this request out to every website that has been visited by their users, without even providing a way for anyone to verify that they are, in fact, government officials.
I should note that I'm a US citizen living in the US and I'm the sole proprietor of the website, and the website doesn't pertain to the EU specifically in any way, which, as far as I understand it, means the GDPR doesn't require me to do anything about deleting private data, even by their own standards. However, I'd still prefer to comply with it even if I don't really have to.