Hacker News Reader

Comment by sseneca | Hacker News Reader

So, I just deleted my account.

15 minutes after I got confirmation of the deletion, I got a "sseneca, welcome to SlideShare!" email, lol.

Yes, me too. Does this mean LinkedIn signed me up again? I want to beleive it's a bug but I don't want to click any links in there.

Update: The username is also obviously auto-generated from my name and not something I would have ever used.

This is what I think is happening.

Pressing "Sign in with LinkedIn" is deceitfully vague, and will create a new account if you don't have one already. So I actually created an account and then immediately deleted it afterwards, but their welcome email was delayed for whatever reason.

Just to be sure, I pressed the "Sign in with LinkedIn" button again and it made me an account again. I waited for the welcome email to come in, and then deleted it once more. I hope that's enough.

Ah, this makes sense. Thanks!

If you don't have an account, you shall get a popup from LinkedIn warning you that you're about to sign up and share data with a third party service (a standard oauth form you also see with Google/Facebook/GitHub auth).

If you get the popup, by all means, do NOT confirm or it will create an account. Haven't heard of people getting the popup though, strong hint that all users were magically autocreated.

Yes I didn't get a popup either time so I'm assuming that LinkedIn, in their infinite benevolence, automatically created an account for me.

I did get a popup, but it was automatically closed before I could interact with it.

Isn't this how all of the "Sign in with X" work? It's the same with facebook and google also where you go through the same OAuth flow where it asks if you want to give this third party access to your data.

My experience is that when I sign up to a service with a previous account, the previous account tells me what data the new service will have access to, and then the new service has a couple of more steps to fully create a new account.

In this example it was "Log in with LinkedIn" -> immediately to the front page. I've never had that before.

That's a GDPR violation right there, assuming you are in the EU.

If the email is "dispatched" the moment you sign in i.e. before the account is delete is not a violation.

Furthermore deletion of the account and information doesn't need to be done instantious, e.g. doing the cleanup once a day in a batch job is ok.

I hate to be that guy but did you actually read the comment? It said "after". So not the moment he signed in, 15 minutes after where to all intents and purposes that should have been impossible.

After all, we can sign people up in 20 milliseconds, I don't see why marking an account as in the process of deletion should be so hard.

Many large sites do batched emails -- it's fully plausible that the email sat in a queue for 15 minutes before going out.

Dispatched != Send != Received

Through I could have been more clear.

Also like I mentioned GDPR doesn't require fast deletion practically delaying the deletion by a day is totally legal as far as I know.

There is another law wrt. opting out from mail under which you maybe (just maybe) could argue it being illegal.

But then again you can always argue there was a delay between dispatch and sending.

GDPR allows up to a month (or more in special circumstances) to delete the account:

> The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject

Article 12.3 https://gdpr-info.eu/art-12-gdpr/

Reply on news.ycombinator.com