About 11 months after they confirmed that my data had been deleted, they sent me an email informing me about their changed Terms of Service. So I guess my email at least wasn't pruned. Who knows how much more data they are holding on.
The safe assumption is that any data a company has ever had on you is still stored by them no matter what they say to the contrary, and will be until the end of time. Apart from being a hermit living in a cave in Montana from birth to death, there is no guarantee of data privacy in the modern world. Anyone who tells you otherwise is trying to get and sell your data.
1. retaining information because of a legal requirement and acting on their legal obligations as is necessary from time to time
2. retaining the information as above while saying that there's no such thing?
The only way I see that to matter is if their TOS said they'd save more data/ save it for longer than legally required. Changing their TOS would then affect what data they'd store on ex-customers if they retro-actively applied it. However, their TOS would be irrelevant in that case, as they'd violate GDPR.
They might also lessen the amount of data they hold on you, maybe after a review of what they actually needed.
I agree they should not send you anything if they store no data whatsoever, but if they do - they should probably inform you about changes in their privacy policies, even if they don't affect you personally.
Are you sure? Laws that compel you to do something usually don't go into effect retroactively. They're like price-hikes in that regard: you can't just unilaterally decide that your customer's monthly subscription fee has doubled since three years ago.
In any case, it wouldn't have anything to do with their TOS or privacy policies, and I don't think they'd have to inform you about their compliance with the current laws.
> they should probably inform you about changes in their privacy policies, even if they don't affect you personally
You're not a customer at that point, why would you be getting information that only concerns customers? Updating someone on the TOS changes implies that they either requested to be updated or are a customer.
I understand the idea behind preferring to err on the side of informing too many people rather than too few, but we should value the recipient's time and attention as well. And once we do that, I believe it's clear that the sender has to spend the extra time to figure out who should receive this email and who shouldn't.
A company that does not validate that the email address actually belongs to the person/entity they have consent from does not have any reason to store and process that email address. The same goes for other PII.
If I sign up with your data, you've never consented, and whatever terms I accepted with a click or two have no relevance to you. Companies just usually don't bother with validation unless they need it for billing purposes, because it's a hassle and might make the customer reconsider.
No, I can widthdraw consent as much as I want. If they have a legal basis for storing my email address, then they can keep it regardless of my consent. However, I have no way of knowing if they actually have a legal basis for storing my email address or if they are just holding onto it.
However if they process your e-mail for several purposes based on different legal basis (for instance they also use e-mail for marketing purposes), they should stop using it for these reasons which you requested (for instance - all applicable) where consent was the basis for processing.