While "deleted" might take a while (eventual consistency FTW), any company with a presence in the EU has a lot to lose if such a scheme (beyond what they declare, eg. "31 days to recover your account") ever sees the light of day.
edit: I've been subjected to Google's dark patterns for so many years that I doubt I will ever trust this company to be honest with me.
If they only use it for something where other factors affect the outcome (ad targeting, etc) they can still keep your data forever while hiding behind plausible deniability the other factors provide them (from outside, there’s no way to prove that a particular ad was served to you because of your data instead of another factor they use as input for the algorithm).
Create an account, use it to excessively look for tea pots until you predominantly get ads for tea pots. Store the cookie[0] that encodes your user id. Delete the account.
After the advertised account retention period, try the cookie again in an otherwise squeaky clean session that gives random ads without the cookie:
Tea pots? Something survived.
No tea pots? No targetting.
(and yes, the onus to demonstrate your accusation well enough to convince a DPA is on you, IMHO as it should be)
[0] or whatever bits of data are necessary: try to recreate the tea-pot session after a logout without logging in officially to determine what's necessary.
They've improved their model none the less even if you delete your data after the fact.
An anecdote: I stayed with relatives for a few days one time, and my two-year-old niece really liked one particular music video on YouTube, so it got played on their TV box 3-4 times during my visit. Not on my laptop, but I used said laptop on their wifi (not logged into Google products, as I never am). When I got home, YouTube highly recommended that video to me after I watched an unrelated video, when there was no other reason to recommend it (I didn't know the artist, almost never watch music videos, and it wasn't anything all that popular).
My IP seems to be permanently associated with my YouTube habits. They’re even being sneaky about it, as in they’ll give you a default homepage and generic recommendations first, but watching any video similar to the previous viewing habits will bring back not just videos related to that one, but the entire history they’ve collected over the years (some of the topics I watch are completely separate and would never intersect normally, so the only way for them to both come up in suggestions is from previous viewing history).
I didn’t create an account, didn’t agree to any privacy policies, and am blocking any and all cookies just like they advise in their own privacy policy and yet I am still being tracked.
"Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person" (Recital 26).
In which case you need a lawful basis for doing such processing (of which consent is just one possibility). Furthermore, that's considered "profiling" and is subject to extra rules if it can have strong impact on the person's life.
On the other hand, if the data is well mixed with other people's, preventing that recognition, then it has been anonymized, and therefore it's not longer subject to the GDPR (Recital 26). But note that you're still subject to it when you're capturing and using personal data to train that model, even if the model itself is anonymized.
Even if a company only does the bare minimum required under GDPR, total deletion of data on request is part of that.
IMO the corporate board of directors will coast on the situation for as long as possible and only then will we see some changes, don't you agree?
There are a few cases already with fines around 2.8% of revenue, and those fines don't mean the DPA will go away. The expectation is that these fines are paid _and_ the reason for the fine is resolved.
Turnover in the 2.8% case (Taxa 4x35 in Denmark) was from Fall 2018 (start of investigation) to March 2019 (when the DPA reported the incident to the police and "recommended" that fine). Sadly the only follow-ups on the case that I could find are behind paywalls (so I can't read them), but apparently the DPA isn't done with them yet.
It's all a matter of exercising pressure, and it seems that the authorities are willing to do that.
"The GDPR is open to interpretation, so we asked an EU Member State supervisory authority (CNIL in France) for clarification. CNIL confirmed that you’ll have one month to answer to a removal request, and that you don’t need to delete a backup set in order to remove an individual from it. Organizations will have to clearly explain to the data subject (using clear and plain language) that his or her personal data has been removed from production systems, but a backup copy may remain, but will expire after a certain amount of time (indicate the retention time in your communication with the data subject). Backups should only be used for restoring a technical environment, and data subject personal data should not be processed again after restore (and deleted again). While this adds some complexity, it allows organizations to have some time to re-engineer their data protection processes." https://blog.quantum.com/backup-administrators-the-1-advice-...
You are absolutely correct that following the intent of the GDPR (we don't have access to the user data once they file the request) is of utmost importance. But the prior poster is correct that the data still exists.
Edit: All opinions my own and not that of my employer, etc. etc.
GDPR covers any interaction of people or organizations in the EU.
So non-EU consumers are covered once they're visiting the EU (citizen of a member state or not), and potentially (untested, not spelled out explicitly) when they use a VPN with an endpoint in the EU (because they're then likely talking to data centers under the control of the European subsidiary).
> they don't have to afford the same protection to non-EU users
Given that "EU user" is murky like that, I'm not sure if any company goes through the trouble of differentiating which action happened from inside or outside the EU beyond raw GDPR blocking that refuse service entirely for accesses from within the EU.