Is it legal to refuse to delete a users account?
On the one hand, we have the EU's "right to be forgotten" actions against Google, which seem to be gaining ground and are essentially bona fide in their protection of the consumer/society, in the sense that it might be a good idea for other jurisdictions to adopt it as well.
But consider the EU (and worldwide) regulation of banking and transactional accounts. Particularly the prohibitions on money laundering and counter-terrorism funding (AML/CTF laws). You're not allowed to open and close a bunch of bank accounts, which means that you don't really have a "right to be forgotten" in this sense either. Nor, if you are not a "legit" user, should you be.
From a technical standpoint, how do you detect the law abiding citizens that want to close (in the sense of permanently deleting records) their account(s) from the malfeasant actors that want to launder money or fund terrorism by holding many accounts over time in order to obfuscate their transaction patterns.
It's an interesting question that the law -- and to a certain extent, the people -- have not yet got a good answer
But even the EU has exemptions and complications around data that's used to prevent crime.
These companies don't seem to tend to think long-term, at least not at this level. It's all about growth acceleration/hacking.
Upon request we delete accounts but if they have transactional data this is still held in accordance with our legal requirements.
We have to keep address details to prove we have charged VAT correctly.
"Thank you for reaching out and providing us with the opportunity to clarify. We welcome and accept employees with all political beliefs at Grubhub, no matter who they voted for in this or any election. We do not discriminate on the basis of someone's principles, or otherwise. The message was intended to advocate for inclusion and tolerance -- regardless of political affiliation -- during this time of transition for our country.
Thank you, Grubhub"