Wow, a 515 page report from McDonald's...

Wayyyy back I requested my FB data back before the data scandal and mass exodus. The data included a transcript of all messenger messages. That was then. No doubt it’s worse now. And people still use it like Zuck and his employees aren’t all peeping Tom’s on those conversations.

“a person on our customer success team”

🤮

Surely that's enough to warrant an investigation and billions of dollars in fines. Surely...?

Some told you they deleted it

That is what I came on here to say. Nothing is ever deleted, you can bet it's exported somewhere else. Who is going to stop them?

this is intentional, make no mistake. the decision has consciously been made to handle things like this

Also... even if a co tries to fill a deletion request in good faith, and even if they didn't sell your data already... it can actually be hard.

Major companies have disaster recovery procedures. Multiple off-site backups. You have to not only remove from all live systems, but w/e kinds of backups exist. Those might be on mag tape in a vault deep underground in a mine! Managed by a whole other data archiving company.

Even deleting from online systems can have issues. Normal delete just removes the dir metadata. The disk blocks remain. You can overwrite to scrub those, but some drives may re-allocate or duplicate blocks on their own, making that hard too.

"Hey why am I on this website, delete me"
"Sure, we'll delete you, thank you for doing the 10,000 pages of opt out paperwork!"
"./ingest_florida_counties_public_records.sh"
"Hey why am I on this website, delete me"
"Sure, we'll delete you, thank you for doing the 10,000 pages of opt out paperwork!"

And repeat.

My uni exam registration website was selling telemetry so I emailed them asking to opt out, and they deleted my exam records :3

that's so cute :3

No <3

The data included a transcript of all messenger messages.

Not to defend Facebook, but it would be weird if they didn't, since you can use messenger on any device, and it's obviously saved on their servers. A transcript of WhatsApp messages would've been different though, as they say they can't read them.

No doubt it’s worse now.

Yeah definitely, and they're probably hiding some the data too.

If only these corporations wouldn't be paying our elected officials.

They did! The field has_been_deleted to Yes for all the records!

In my country, you have a legal right to your medical data. I asked for it, it got denied: too much work. I could get 6 non-related pdf files on a USB stick I had to pay for.

A friend of mine worked for a medical temporary employment agency. In accordance with EU GDPR law, upon request of deletion of data, you are legally required to do so. He told me he wasn't allowed to by his boss, he had to reply with "yup we deleted all of it" while in fact they would keep it. I assume many companies do this.

Hope they get absolutely reamed by the regulator.

I'm still being treated there, so don't want to start a fight.

My friend signed an NDA so reporting it would get him into trouble.

So they just get away with it.

I don’t think NDA’s cover hiding illegal activity.

you can bet it’s exported somewhere else

Yeah, as an attachment on a forum accessible via Tor ;)
Great backup system, just costs quite a bit to get it back though.

I feel like reporting illegal behavior supercedes any contact you signed, but I'm not a law person

I feel the same way, but it's not my ass getting the legal hassle.

I wouldn't hold my breath

Altering backups is not required. But it has to be "marked", so even when the backup is used that is removed.

I do not believe a single company deletes your data. They might change your PII so it cant be specifically attributed to you. But they are keeping the rest.

I process data deletion requests for one of my business clients, and we are quite thorough about it, but with so many intersecting apps engaged in third party data storage it can be challenging tracking down the crumbs.

Laws don't mean shit without enforcement.

Nothing is deleted, just your access to it is removed. Sometimes the wording makes this clear.

Would not surprise me one bit to learn that your job is just to cover their ass. That you're not deleting anything that hasn't been backed up. But, if the shit hits the fan they can point to you and your records to "prove" they are deleting stuff.

I don't trust billionaires at all.

I worked on a whistleblower software. Based on the regulations we had to develop for your friend should be able to submit their whistleblower information and still be employed without the employer knowing who submitted the information

There's strong whistleblower protections in the EU

Oh, that company is run by millionaires not billionaires and they are pretty sincere in not wanting to keep data that is requested for removal.

Having been hit by accessibility and copyright legal trolls has made them kind of gun shy though.

I have convinced them that they won’t miss it, plus I set up an easy and documented workflow.

My friend signed an NDA so reporting it would get him into trouble.

Uh, does an NDA still count if it's about illegal stuff? Wouldn't following the NDA in that case be some kind of conspiracy to commit fraud?

Fines are in the millions of euros if they don't.

They usually do. The EU doesn't fuck around with GDPR

Fortunately the EU enforces the fuck out of GDPR

“That’s crazy,” said Ben Winters, director of AI and privacy at the Consumer Federation of America

What the fuck is that title?

In accordance with WIRED’s policies, I am disclosing that I used generative AI

Is ars the same thing as wired now?

My takeaway: I should be able to just attack someone by telling a company to delete all their data.

I wonder how many social media or email providers will let me delete someone else's account?