Hacker News Reader

I'm almost certain this is the reason. A lawyer somewhere in the company has seen "PII retained indefinitely" and lost their shit over it without ever looking at the context around that. No doubt a bunch of people internally have been hammering them with "but this will look terrible when we remove people's access to products they bought".

View on HN

Any lawyer even vaguely familar with GPDR wouldn't be worried about this. There is a text that states: "processing is necessary for the performance of a contract to which the data subject is party.." and "processing is necessary for compliance with a legal obligation to which the controller is subject".

It could be easily argued that providing an end customer with access to digital products they bought is part of the service that data subjects signed up for, so retaining PII indefintely is 100% allowed (unless the data subject explicitly requets their account to be permanently deleted).

[1] https://gdpr-info.eu/art-6-gdpr/

You are probably right. Most of my experience with corporate lawyers has been all about minimizing risk even if it means losing out on substantial business while there has been zero interest to find a solution. The root cause, as usual, is terrible incentive design where lawyers get punished when a legal problem occurs, but don't get rewarded when they consulted on finding a good solution that allowed the business to thrive.

Reply on news.ycombinator.com