3

I made the following request

My name is _ I am a citizen of the EU. My email addresses are _ and _

In accordance with Article 17 of the GDPR I request you to erase all personal data that you hold about me.

Please send me an email confirmation of the complete erasure of the personal data once you have completed the erasure process.

Today I received the following response:

Thank you for contacting _ and sending us your request for account deletion. Please note that deleting your _ account is permanent and irreversible. Any unused items or _ Money cannot be refunded. _ is a U.S. company not actively marketing in the European Union. Therefore, we are not covered under the GDPR.

Note that email address is only used for verification purposes and is not connected to your _ account. You can submit your deletion request following the instructions for your operating system:

iOS

  1. Click on the three-dot 'More' menu
  2. Click on Settings and then FAQ
  3. Scroll to find 'How do I delete my account?' and expand
  4. Click on Delete Account and follow the instructions. If you require a confirmation receipt, make sure to enter your email address when prompted.

Android OS & Web version Change your account's username to [current username]-DA to confirm the ownership of the account, and let us know once the change has been made by replying to this email. *If your username is more than 7 characters long, keep the first 7 characters and add -DA to meet the character limit.

Once we hear back from you, we will begin processing your request and send you the confirmation once the process is complete. This may take up to 45 calendar days from the date of your initial request.

We would also appreciate it if you could share why you have decided to leave _. This will help us improve our services in the future.

I can't log into the site to change my username anymore. But even if I can't login they still need to take down my information, no?

4
  • 1
    If the information you have given/proven is not enough to identify you as the owner of said account or information you want deleted, they will not delete it, GDPR or not. Why can't you log in?
    – nvoigt
    Commented Aug 23, 2023 at 8:42
  • 1
    "Not actively marketing" is not the same as "[not] offering goods or services", but it sounds like they have provided a way to achieve what you want and the real problem here is a technical issue with getting into your account - they would have no trouble demonstrating a good faith attempt to comply with your request. Would resolving the technical issue be a better solution than throwing the law at them? Commented Aug 23, 2023 at 11:13
  • As a trader I held an account with a card processing company. When I closed the account I asked them to delete my details completely, and they replied We are required to hold your data for a period of time after the end of our relationship to comply with relevant tax laws and other laws. This does seem to make sense: otherwise I could open a bank account, launder some money through it, close the account and vanish without trace - no audit trail. Commented Aug 23, 2023 at 13:04
  • My email address is essentially my name. I gave them both my name and email.
    – dranxo
    Commented Aug 23, 2023 at 17:22

2 Answers 2

5

Not if they are not subject to the GDPR

For a foreign organisation to be subject to the GDPR, one of two conditions must be met:

  1. They are "offering goods and services" to "data subjects in the Union", or
  2. They are monitoring behaviour that takes place within the EU.

They are adopting the position that they are not "offering ... to data subjects in the Union." You haven't told us what goods or services the company supplies, so it's impossible to tell if this is true. Merely making things available on the web is not necessarily offering them to the EU - my local pizza place in Australia allows online ordering, but they are clearly not offering goods to the EU - even if you were kind enough to order a pizza and have it delivered to me.

Again, without knowing what they do, it's impossible to say if they are monitoring your behaviour.

If they aren't doing either of those things, then the GDPR does not apply.

And sometimes, not even if they are

... the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

Again, don't know what they do, so don't know if this applies.

Enforcement

If you think they are covered, you can report the matter to your country's regulator or take legal action yourself.

Whether the regulator will take action depends on their resources, their assessment of the prospects of success, and their assessment of the prospects of recovery. Fines issued in a European Court will usually be enforced by a US court, but the process is tedious, long, and complex.

Your decision on whether to take action should be guided by the same principles.

2
  • 4
    The claim by the company ' not actively marketing in the European Union. Therefore, we are not covered under the GDPR.' is just false. The Australian pizza place does indeed not offer goods and services to EU subjects but that is because their business is delivering pizzas and they deliver only to Australia not because of any marketing. A lot of websites immediately satisfy the monitoring because they use tracking cookies that apply to everyone including to EU subjects.
    – quarague
    Commented Aug 23, 2023 at 12:47
  • Is it marketing or monitoring? The website in question is a discussion forum. It has plenty of EU users but I would not be surprised if they simply don't buy ads in the EU.
    – dranxo
    Commented Aug 23, 2023 at 17:39
0

I think whether they are subject to the GDPR is not the key point here. You requested that they should delete your account and they responded with detailed instructions on how to do that. So do it and your data is gone.

Your wrote you can't log in anymore but don't explain why? If you lost your password or something similar you might first have to go through some account recovery steps and once you have full access to the account again you can delete it as described in their response.

1
  • -1 Not exactly a good answer. Just because they have a 'delete your account' button does not mean the level of deletion is the same as what would be done under GDPR compliance. They could just set the IsDeleted field on all my data to true and my account is now 'deleted'. Doesn't stop them from using the data they still have. GDPR is specifically meant to clear data that they might otherwise keep. Commented Aug 28, 2023 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .