Hacker News Reader

Comment by closeparen | Hacker News Reader

I think it's pretty rare that a business is going to erase all record that a transaction ever occurred, particularly a transaction involving other people (merchants, gig workers). Rather they are going to erase your association with the transaction, by rewriting your account as a "tombstone" account with fake details. That's a pretty normal approach.

View on HN

You have to show a pretty strong need to keep PII after a user has expressly withdrawn their permission for you to carry on processing it.

No, it's not uncommon to "tombstone" data, but when you do that, you should remove data you have no rights to any more. Order numbers, accounting, payments that sort of stuff is all fair game (for limited time), but the point here is it appears they're not deleting anything, they're just moving it to be inaccessible to the user.

They keep the data. And that's a) scummy and b) illegal in several jurisdictions.

If the records no longer contain PII, then they've arguably satisfied their duties under the law, haven't they? Has a court held otherwise?

But the records do.

> Your account showing your name, address, credit card, etc can still be accessed whilst the token stored in the cookie is still valid

They're also given time for the deletion to be fully complete -- backups etc.. That could apply here.

I think replacing the userid with an ID that isn’t reversible but keeps all the foreign key constraints is acceptable.

Correct for transaction data. Such data is owned by hello fresh and they need to keep it (for financial reporting, for instance).

However OP talked of master data. That should be removed when user asks to delete their account.

If it really keeps credit card details, that’s way more than just a tombstone.

(Asking out of ignorance, I don’t know how this works)

Suppose HelloFresh found out they should give you a refund after you deleted your account. Would they need the credit card to do that?

They could mail a check.. oops now they need your mailing address

Or they could call you and ask.. oops now they need your phone number

etc

In your scenario are you suggesting that HelloFresh start sending people refunds unprompted? That doesn't exactly sound likely, but sure, they could stick a "Disclaimer: If you delete your details it may make it more difficult for us to refund you if we suddenly lose our minds and start inexplicably sending refunds to people unprompted".

In general, it’s not that strange to sell something then realize you can’t actually deliver it and make a refund. I guess HelloFresh is a little bit different from the average e-commerce business because they sell perishable food. But probably there’s some case where they would take some money then later decide to give it back.

Encrypted archival of PII for a limited time, say a year. GDPR allows the storage for legal reasons.

A one way hash of PII, salted, stretched, this is enough to verify identity but also doesn't keep the PII directly (I know only 8 billion people on earth is not enough entropy. Still you make a legal effort and segregate it from your network)

you only need the transaction details to call your payment gateway to do the refund, unless you are the payment gateway.

Reply on news.ycombinator.com