Is it legal to refuse to delete a users account?

This is actually a great technical and legal question. And it depends a lot on the type of service you have, and which jurisdiction's law governs you and your service provider.

On the one hand, we have the EU's "right to be forgotten" actions against Google, which seem to be gaining ground and are essentially bona fide in their protection of the consumer/society, in the sense that it might be a good idea for other jurisdictions to adopt it as well.

But consider the EU (and worldwide) regulation of banking and transactional accounts. Particularly the prohibitions on money laundering and counter-terrorism funding (AML/CTF laws). You're not allowed to open and close a bunch of bank accounts, which means that you don't really have a "right to be forgotten" in this sense either. Nor, if you are not a "legit" user, should you be.

From a technical standpoint, how do you detect the law abiding citizens that want to close (in the sense of permanently deleting records) their account(s) from the malfeasant actors that want to launder money or fund terrorism by holding many accounts over time in order to obfuscate their transaction patterns.

It's an interesting question that the law -- and to a certain extent, the people -- have not yet got a good answer

RtbF is possibly not relevant here. More important would be the EU regulations on data protections. These say that companies must explain what data they're gathering and why they gather it; and that companies can only gather what they need; and only keep it for as long as they need; and that it must be accurate; and that customers have a right to see the data and to have corrections made.

But even the EU has exemptions and complications around data that's used to prevent crime.

Google retaliates though by putting the reasons for removal on "chillingeffects.org". Chilling indeed that a company has no respect for privacy.

I'm seeing a few replies suggesting that it varies between EU/US etc ... but either way it sounds like a REALLY effective way to piss off those customers and guarantee they'll never come back and use your service in future (or share such "horror" stories with their friends and relatives). I don't get why those companies would go out of their way to make things difficult for themselves in the long run

(Sorry, late.)

These companies don't seem to tend to think long-term, at least not at this level. It's all about growth acceleration/hacking.

HMRC (UK Tax Office) requires us to keep transactional information for 6 years.

Upon request we delete accounts but if they have transactional data this is still held in accordance with our legal requirements.

Transactional data surely does not have to include full card and address details though. That would contradict EU directives on sensitive data and privacy.

We do not keep any card data.

We have to keep address details to prove we have charged VAT correctly.

I think in some countries companies/websites have to keep a trace of all accounts. So they don't really delete accounts, pretend they do and move them to another DB.

Not in the EU.

Yes. Unless they said otherwise in their TOS.

Actually, it depends on a country. For example, EU laws override ToS.

Only for companies under EU jurisdiction.

Pretty much all bigger companies have subsidiaries in EU (Uber included), so they must obey EU laws too. I think it's only a matter of time when Uber will get sued for privacy violations.

thats what i assumed too. they outright told me that they won't delete my account. Instead they sent me bunch of these totally irrelevant emails to me( probably just made a false assumption due to the timing)

"Thank you for reaching out and providing us with the opportunity to clarify. We welcome and accept employees with all political beliefs at Grubhub, no matter who they voted for in this or any election. We do not discriminate on the basis of someone's principles, or otherwise. The message was intended to advocate for inclusion and tolerance -- regardless of political affiliation -- during this time of transition for our country.

Thank you, Grubhub"