Hacker News Reader

Hacker News

Comment by babarock | Hacker News Reader

Full thread

babarock

A couple of questions pop to mind:

- Will that affect the work of archive.org and the wayback machine?

- Is it okay for a politician to "erase" something he/she said 10 years ago?

View on HN

The question that pop into my mind is "What about purchase history?"

We run a webshop and sometimes a get customer that demands that we delete all their information. They are entitled to make that demand, but at the same time we're required to store the same information for at least two year, in order to be able to handle returns, and maybe five years due to accounting.

I really do applaud the court for their intentions, but it leaves a lot of unanswered questions and challenges. In our case we would have to make serious changes to our ERP/CRM systems, it currently do not allow deletion of data, because that would be bad for accounting. Also: Can I deny you warrenty because you requested that I delete all data regarding your purchase and person?

You do not need to delete the whole data. Just make it no personal data. Just erase the name, birthday and maybe the street.

In our case, based on what is "personal data" in Denmark, we would need to delete: name, address, phonenumber and email, that leaves us with the order number. the problem with that is that now we can't tell if it's the original customer that contacts us for a repair or refund, he could just share the order number with a third party... Yes, people actually try that.

What is the problem? If the customer has a valid receipt, the customer is entitled to have the repair / refund. There must be no difference to buying something in a physical store.

What consists of a "valid receipt" for a digital purchase? An email? A printed copy of an email? Either can be trivially forged if the company has no way of verifying the information.

Usually, when I order something online, I get an receipt via mail and paper (with the shipment). Mail and paper receipt contain order details which can be used to prove the legitimacy. And you can always sign the receipt (plain/text or attachment with the mail, QR code with the paper receipt).

It is important not to delete the order data, but to anonymize the user data. Your shop software should be able to handle this. Otherwise, I would use another product ;)

You don't have to delete it if you can demonstrate that it's necessary to run your business. That's my understanding, anyway.

Google can demonstrate that they need my information and publications to run their business.

Need is quite specific here - I suspect you need something more than Google can offer. E.g. required by legislation as part of running the business would be sufficient.

I don't agree.

I think they could perhaps argue that they need some information and some publications to run their business to its fullest potential.

I'm not sure they could prove that losing mrweasel's data is going to cause them any significant harm as a business, though.

Is is searchable for random person from his home PC? If answer is no, than probably no.

I'm pretty sure that a customer still have the right to demand that we delete any information about him or her, but I could be wrong.

I think this is more about data that is being displayed publicly. I don't think purchase history falls into that realm, as that is private data that you have a right/responsibility to keep for your webshop's records. Just don't display it publicly, obviously.

You could send them an email containing a digitally signed receipt. If they ask for their data to be deleted and then later want to make a return, they could send you back the email.

While I do like the idea, that not how your average customer work. Don't get me wrong, I love our customers, but here's a short list of weird stuff we seen from them:

* Forget which phone number they used.

* Switch to a email provider and don't transfer emails.

* Delete email 5 seconds after receiving it.

* Enter wrong email address, twice.

* Forget where they live... ?

* Forget order number.

* Give you an order number for a different webshop.

* Call and tell you that you're spamming ( i.e. sending an order confirmation )

Yes, you and I will save an email for two years, the average customer won't.

Still, I'm loving the idea.

i really doubt it covers purchase history. I think it covers more about the right to ask a blog/social media to remove your identify from the page. alison stokke would be stoked about this news

It is not necessarily deletion, but the "right to be forgotten".

Anonymize the data to the extent that the customer is no longer recognizable as the user, but you still have your information for accounting purposes.

The wayback machine seems (to me) to be breaking EU law before we get to data protection; there is a copyright issue as well:

https://en.wikipedia.org/wiki/Wayback_Machine#Legal_status

And what about my personal records of anything I see that looks interesting?

To the second: no. This is of public interest and public record.

But what about a few month before he declares his interest for running for office?

well make the difference between a user's profile data and a blog post/article.

Although I admit I don't know what sort of policy archive.org uses.

Reply on news.ycombinator.com