PSA: HelloFresh doesn't delete data when asked, only changes the email address

Re:PSA: HelloFresh doesn't delete data when asked, only chan... by oliwarner on Thursday May 26, 2022 @07:11PM (#31524405)

You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it.

No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they're just moving it to be inaccessible to the user.

They keep the data. And that's a) scummy and b) illegal in several jurisdictions.

[ Parent | on HN ]

Re:PSA: HelloFresh doesn't delete data when asked, only chan... by otterley on Thursday May 26, 2022 @09:13PM (#31525118)

If the records no longer contain PII, then they've arguably satisfied their duties under the law, haven't they? Has a court held otherwise?

[ Parent | on HN ]

Re:PSA: HelloFresh doesn't delete data when asked, only chan... by oliwarner on Friday May 27, 2022 @02:01AM (#31526458)

But the records do.

> Your account showing your name, address, credit card, etc can still be accessed whilst the token stored in the cookie is still valid

[ Parent | on HN ]

Re:PSA: HelloFresh doesn't delete data when asked, only chan... by zbuf on Friday May 27, 2022 @09:19AM (#31529269)

They're also given time for the deletion to be fully complete -- backups etc.. That could apply here.

[ Parent | on HN ]

Re:PSA: HelloFresh doesn't delete data when asked, only chan... by edmundsauto on Friday May 27, 2022 @01:24AM (#31526255)

I think replacing the userid with an ID that isn’t reversible but keeps all the foreign key constraints is acceptable.

[ Parent | on HN ]