Hacker News Reader

Comment by mrweasel | Hacker News Reader

The question that pop into my mind is "What about purchase history?"

We run a webshop and sometimes a get customer that demands that we delete all their information. They are entitled to make that demand, but at the same time we're required to store the same information for at least two year, in order to be able to handle returns, and maybe five years due to accounting.

I really do applaud the court for their intentions, but it leaves a lot of unanswered questions and challenges. In our case we would have to make serious changes to our ERP/CRM systems, it currently do not allow deletion of data, because that would be bad for accounting. Also: Can I deny you warrenty because you requested that I delete all data regarding your purchase and person?

View on HN

You could send them an email containing a digitally signed receipt. If they ask for their data to be deleted and then later want to make a return, they could send you back the email.

While I do like the idea, that not how your average customer work. Don't get me wrong, I love our customers, but here's a short list of weird stuff we seen from them:

* Forget which phone number they used.

* Switch to a email provider and don't transfer emails.

* Delete email 5 seconds after receiving it.

* Enter wrong email address, twice.

* Forget where they live... ?

* Forget order number.

* Give you an order number for a different webshop.

* Call and tell you that you're spamming ( i.e. sending an order confirmation )

Yes, you and I will save an email for two years, the average customer won't.

Still, I'm loving the idea.

I think this is more about data that is being displayed publicly. I don't think purchase history falls into that realm, as that is private data that you have a right/responsibility to keep for your webshop's records. Just don't display it publicly, obviously.

You don't have to delete it if you can demonstrate that it's necessary to run your business. That's my understanding, anyway.

Google can demonstrate that they need my information and publications to run their business.

Need is quite specific here - I suspect you need something more than Google can offer. E.g. required by legislation as part of running the business would be sufficient.

I don't agree.

I think they could perhaps argue that they need some information and some publications to run their business to its fullest potential.

I'm not sure they could prove that losing mrweasel's data is going to cause them any significant harm as a business, though.

You do not need to delete the whole data. Just make it no personal data. Just erase the name, birthday and maybe the street.

In our case, based on what is "personal data" in Denmark, we would need to delete: name, address, phonenumber and email, that leaves us with the order number. the problem with that is that now we can't tell if it's the original customer that contacts us for a repair or refund, he could just share the order number with a third party... Yes, people actually try that.

What is the problem? If the customer has a valid receipt, the customer is entitled to have the repair / refund. There must be no difference to buying something in a physical store.

What consists of a "valid receipt" for a digital purchase? An email? A printed copy of an email? Either can be trivially forged if the company has no way of verifying the information.

Usually, when I order something online, I get an receipt via mail and paper (with the shipment). Mail and paper receipt contain order details which can be used to prove the legitimacy. And you can always sign the receipt (plain/text or attachment with the mail, QR code with the paper receipt).

It is important not to delete the order data, but to anonymize the user data. Your shop software should be able to handle this. Otherwise, I would use another product ;)

It is not necessarily deletion, but the "right to be forgotten".

Anonymize the data to the extent that the customer is no longer recognizable as the user, but you still have your information for accounting purposes.

Is is searchable for random person from his home PC? If answer is no, than probably no.

I'm pretty sure that a customer still have the right to demand that we delete any information about him or her, but I could be wrong.

i really doubt it covers purchase history. I think it covers more about the right to ask a blog/social media to remove your identify from the page. alison stokke would be stoked about this news

Reply on news.ycombinator.com