GDPR takedown request unsuccessful

Question

I made the following request

My name is _ I am a citizen of the EU. My email addresses are _ and _

In accordance with Article 17 of the GDPR I request you to erase all personal data that you hold about me.

Please send me an email confirmation of the complete erasure of the personal data once you have completed the erasure process.

Today I received the following response:

Thank you for contacting _ and sending us your request for account deletion. Please note that deleting your _ account is permanent and irreversible. Any unused items or _ Money cannot be refunded. _ is a U.S. company not actively marketing in the European Union. Therefore, we are not covered under the GDPR.

Note that email address is only used for verification purposes and is not connected to your _ account. You can submit your deletion request following the instructions for your operating system:

iOS

1. Click on the three-dot 'More' menu
2. Click on Settings and then FAQ
3. Scroll to find 'How do I delete my account?' and expand
4. Click on Delete Account and follow the instructions. If you require a confirmation receipt, make sure to enter your email address when prompted.

Android OS & Web version Change your account's username to [current username]-DA to confirm the ownership of the account, and let us know once the change has been made by replying to this email. *If your username is more than 7 characters long, keep the first 7 characters and add -DA to meet the character limit.

Once we hear back from you, we will begin processing your request and send you the confirmation once the process is complete. This may take up to 45 calendar days from the date of your initial request.

We would also appreciate it if you could share why you have decided to leave _. This will help us improve our services in the future.

I can't log into the site to change my username anymore. But even if I can't login they still need to take down my information, no?

Answer 1

Not if they are not subject to the GDPR

For a foreign organisation to be subject to the GDPR, one of two conditions must be met:

1. They are "offering goods and services" to "data subjects in the Union", or
2. They are monitoring behaviour that takes place within the EU.

They are adopting the position that they are not "offering ... to data subjects in the Union." You haven't told us what goods or services the company supplies, so it's impossible to tell if this is true. Merely making things available on the web is not necessarily offering them to the EU - my local pizza place in Australia allows online ordering, but they are clearly not offering goods to the EU - even if you were kind enough to order a pizza and have it delivered to me.

Again, without knowing what they do, it's impossible to say if they are monitoring your behaviour.

If they aren't doing either of those things, then the GDPR does not apply.

And sometimes, not even if they are

... the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

Again, don't know what they do, so don't know if this applies.

Enforcement

If you think they are covered, you can report the matter to your country's regulator or take legal action yourself.

Whether the regulator will take action depends on their resources, their assessment of the prospects of success, and their assessment of the prospects of recovery. Fines issued in a European Court will usually be enforced by a US court, but the process is tedious, long, and complex.

Your decision on whether to take action should be guided by the same principles.

Answer 2

I think whether they are subject to the GDPR is not the key point here. You requested that they should delete your account and they responded with detailed instructions on how to do that. So do it and your data is gone.

Your wrote you can't log in anymore but don't explain why? If you lost your password or something similar you might first have to go through some account recovery steps and once you have full access to the account again you can delete it as described in their response.