3

Of course my default way of thinking is: deleted: true while keeping all the data in place.

In fact I would be interested in knowing what standard operating procedures are in place for retention of personal data. Or maybe I shall write directly to the HQ?

I would be really interested in knowing how to guarantee that my data after I close the account is irrevocably destroyed.

In other words the question is - how to close account and be sure that data is actually removed?

Improve this question
3
  • 1
    Short answer: no. Each service will have their own processes and data stores, and you have no power over how they use them. You cannot be sure that your data has been deleted.
    – schroeder ♦
    Oct 25, 2015 at 23:31
  • I'm not sure that the JLM link has anything to do with your question.
    – schroeder ♦
    Oct 26, 2015 at 3:41
  • JLM - Jennifer Lyn Morone - jenniferlynmorone.com - I find this case greatly interesting and inspiring and actually on-topic with regards to use of personal data. I'd much rather sign a deal between MichalStefanow.com and Facebook allowing them to access my data and providing social-networking services. I really wish I was in possession of my personal data.
    – Mars Robertson
    Oct 28, 2015 at 11:16

2 Answers 2

Reset to default
5

It is almost certain that whatever you do, your data will not be irrevocably destroyed.

Even if the organisation you trusted with your personal data had the best of intentions it would be an enormous effort to really physically delete all of your data from all the places it will have been duplicated to, including backups and SSD spare sectors. No organization can economically justify that effort for an account you didn't pay anything for to begin with, so that will not happen. The best you can hope for is that they will actually delete the data on the OS or DBMS level, and the remnants on the physical media will later be overwritten when the physical media location happens to be reused.

But even that is far from certain. Your data may already have been incorporated in other databases as consented by you by clicking on the Accept button when you signed up, and remain there even if your account is destroyed. The organization may be under a (possibly secret) obligation from the authorities to preserve deleted accounts for legal investigation or information gathering by intelligence agencies. It may have a policy of keeping the data from deleted accounts for a few days, weeks, months, or years just in case it'll be needed again. You have no way of knowing. More importantly, you have no way of verifying what they have done. You can only trust and hope.

Improve this answer
8
  • 4
    While this is all true for free services (Facebook, Dropbox) there are cloud services that offer to fully and completely delete your data from their systems upon your request (I work for one and I'm the one who certifies that the data is deleted).
    – schroeder ♦
    Oct 26, 2015 at 3:39
  • @schroeder If you take all the precautions necessary to protect against a disgruntled employee deleting data, then it will be very hard to guarantee rapid deletion of data on request from a user.
    – kasperd
    Feb 25, 2016 at 15:39
  • @kasperd is the question the guarantee of deletion or guarantee of rapidity?
    – schroeder ♦
    Feb 25, 2016 at 16:28
  • @schroeder That probably depends on customer expectations. If you want to keep backups for a month to ensure malicious deletions are noticed before it is too late, then legitimate deletions cannot be guaranteed to happen any faster than one month plus whatever overhead you have due to the way backups are structured. Will your customers be understanding if it takes more than a month to get confirmation of deletion?
    – kasperd
    Feb 25, 2016 at 16:35
  • 1
    @kasperd in my case, we designed the backup solution so that data could be purged from it within 30 days of a request. I'm not sure if that's "rapid", but it is certainly a reasonable timeframe.
    – schroeder ♦
    Feb 25, 2016 at 17:33
0

You can not be sure about it. Because source code is closed and they don't share their data dump weekly. Even they share their data dump it can be a trickery.

I know that in Turkey, Facebook have to share suspects data(i.e. chat messages) with law enforcement because of the recent legislations. And I know that Facebook sharing the data, I saw it with my own eyes. Same situation is valid for other social networks too.

So there is a probability of an account removing/closing request is related with a lawsuit. Because of that, they can not actually remove the data if there is a lawsuit.

Even though the company's it self can decide to not remove the data cause of profit-oriented point of view.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.