So where is the cutoff? My one free user obviously didn't make the cut. But 100 does? 1000?
Normal logs/bookkeeping need to be kept anyway if you are running a business. And special legal letters are special by definition.
I'm still not seeing why google outright couldn't delete a million random free accounts if they wish. It'd be bad for reputation but execs have done similar in the past.
I am not saying I like it. I am not saying I want it to be a certain way.
I am trying to point out that all these free accounts are running on servers provided by a business. They are subject to the whims of the business and the market the business operates in. If the business fails, so do the accounts.
But the short answer is that where is the line depends on jurisdiction, it is often along the lines of what they consider a hobby, a small business, large business, and so on.
> Anything dealing with user deletion should go through a well established, legal approved process.
Which seems prohibitive. As though someone's personal emails/tweets/images on a free account are somehow protected from the whims of a high enough exec.
But as far as I can tell, it is within legal bounds for a business to freely give and taketh away free accounts if they wish. The only thing stopping them from mass account deletion is public perception.
You’re just pretending a business transaction is a person one. It is not.
- some countries require saving "the last known address"
- others require keeping logs about "the last known connection point" (IP)
- in some countries, if the user was a paying user, you need to retain payment details / invoices / etc for years
- some countries you can receive subpoenas that mandate what data should be retained
All these things need to be checked before deleting an account. Having a "manual" deletion endpoint would be more troubling.
As an aside, early in the GDPA implementation phase, there was coverage of many companies implementing it poorly at best. There are articles detailing how you could delete a user's account by sending the "required info" (e-mail, ssn) from another e-mail and they'd delete the account / send over data. Would you be comfortable with someone being able to delete your account like that?