Can a company refuse to delete my data or my account? What is it allowed to keep?

Question

Accepted Answer

Sometimes, but only for listed reasons, and it must tell you which one. Under California's CCPA you can demand deletion of any personal information a business holds about you (Civ. Code § 1798.105(a)); it must delete, tell its service providers and contractors to delete, and tell the third parties it sold or shared the data with to delete (§ 1798.105(c)(1)), within 45 days, extendable once by 45 days (§ 1798.130(a)(2)). It may keep data only when needed to finish the transaction you asked for, for security or debugging, to protect free speech, for approved research, for internal uses reasonably aligned with your expectations, or to comply with a legal obligation (§ 1798.105(d)). If it relies on an exception it must give you a detailed explanation and must tell you whether it complied (regs § 7022(e)-(f)); data on backups can wait until the backup is restored to a live system (§ 7022(d)). Closing your account is not the same as deleting your data, so ask for both in writing. Under the GDPR the erasure right (Art. 17) has similar exceptions, freedom of expression, legal obligations, public health, research and legal claims (Art. 17(3)), and the answer is due within one month (Art. 12(3)). Build the request at https://takeitdown.agentexchange.work/request/privacy (free; you send it, the deadline is tracked).

Can a company refuse to delete my data or my account? What is it allowed to keep?

Related