Hacker News Reader

Comment by mLuby | Hacker News Reader

Last year I told Robinhood to "delete (not just close) my account and related data." I hadn't used the service in years and wanted to reduce their annoying "your account statement: still $0" emails as well as to reduce my online exposure to data breaches.

Now I get an email from them that not only did they not do what I asked, they did indeed serve my data to criminals.

Is there some legal mechanism to compel companies to delete your data rather than this "soft-delete" garbage? Registering an account with a new website these days feels more and more like a stain one will never be able to wash away.

View on HN

> Is there some legal mechanism to compel companies to delete your data rather than this "soft-delete" garbage?

You could take a copy of the original e-mail and a copy of the notice and send them, with a cover letter, to your state securities regulator [1]. If you want to turn up the heat, submit a complaint to FINRA [2]. If you want to be peskier, and live in California, submit a CCPA complaint [3].

[1] https://www.nasaa.org/contact-your-regulator/

[2] https://www.finra.org/investors/need-help/file-a-complaint

[3] https://oag.ca.gov/contact/consumer-complaint-against-busine...

I don't think there is any rule or law requiring companies to hard delete customer data. I would bet that most companies never delete based on know your customer, anti-laundering, and other SEC regulations.

I just looked into this, because I tried to delete my account yesterday as well. Normally you can use a CCPA request to nuke your data, but reading Robinhood's T&C it looks like they aren't obligated to delete much since they're a financial institution. Various regulations require them to keep records.

So ... we're basically screwed with Robinhood.

A tightly regulated securities broker is not going to be able to comply with your request to just go ahead and delete your account and all related data.

Brokerages are required by law to retain a great deal of records about all of their clients and to keep it for a minimum of at least 5 years. You don't get to just tell a broker that you used to engage in tightly monitored financial transactions that you want all your info deleted as if you were dealing with some kind of social network.

Im not sure about your case but if you did any trading in that calendar year they might have been forced to keep your data until they sent out all the required tax forms to customers.

If that is not the case then yes its super annoying how hard it is to actually remove your data from websites.

I consult with large companies, and right-to-be-forgotten generally just isn't a priority for them. It keeps getting moved down the backlog. Furthermore, accounts get deleted accidentally all the time, so managers are reluctant to hard-delete.

Then there are the peripherals - global db backups with x expiration date, random documents on various cloud providers, etc.

In short, I 100% agree that you should keep your main email (at the very least) off of anything possible.

I don't even have an account with Robinhood. I've never done any business with them but somebody else set up an account with my email address. After taking way too long to have my email removed from that account, they now managed to give it to some criminals as well.

I get emails from legitimate companies (including Wells Fargo, a major U.S. bank) meant for others, because they never validated the email address their customers gave them.

Email Address Validation is not "yep, that looks like an email address", it's "let's send a confirmation email and have them click on a link".

Please do NOT trust users when it comes to email addresses!

This is why you verify email addresses. Especially with financial institutions.

Mint used to send me somebody else's statements. I don't understand how companies in sober industries can be this reckless.

I'm pretty sure it would be illegal for RobinHood to actually delete information about you after you are a customer. They are required to keep a history of your activity and transactions in case they get sued, audited or come under investigation. I do not know what the actual retention period would be but it's certainly longer than just a few years.

It may be very difficult to fully delete an account. Assuming there are various backups laying around. I assume most companies mark a "deleted" flag as that's the safest. Some maybe delete the record, but I doubt most if any purge you from backups.

> Is there some legal mechanism to compel companies to delete your data rather than this "soft-delete" garbage?

Yeah, GDPR and California's equivalent thing. Hacker News seems to really dislike it for some reason though.

I guess if you're building a business you don't see it from that perspective, just another hurdle stopping you from moving fast and leaking things

They’re a bank. You can definitely close your account. I did it when I needed to graduate to a “big boy” brokerage. If they aren’t doing it, contact the CFPB for help & advice.

Why not contact a class action lawyer instead? I’m sure OP isn’t the only one who deleted his account, only to discover it wasn’t actually deleted and is now in the hands of criminals.

Because going through the CFPB is probably OP’s fastest course of action, vs potentially multiple years of litigation. Besides, the demand letter has to start from somewhere.

> Is there some legal mechanism to compel companies to delete your data rather than this "soft-delete" garbage?

Yes. GDPR (and other legislations basing themselves on this). The US has CCPA if you're in california for example.

Unfortunately, and this applies more or less worldwide, you can't count on this for anything financial. Expect financial institutions to have to legally keep your data for 7-10 years (sometimes even 20). This is one of those cases where soft delete might be the best they can do for you.

Reply on news.ycombinator.com