It has now been at least three working days since I requested my account to be deleted. I am now wondering whether it is worth considering submitting a GDPR request in addition, even though that increases the amount of work for everyone involved. What are the main Pros and cons if this, both for me and any (European based) user who wants to leave the site in future?
-
@Tom I expect them to speed up the normal delete process in future if enough people start doing it .... :-)– user5940189Commented Dec 12, 2019 at 14:42
-
3Is the current delay illegal? Cause honestly, I feel like catering to the needs of people who want to leave the platform is not the kind of important improvements they will want to focus on :/. (I get why you wanna push it... I'm just trying to be realistic :/ )– PatriceCommented Dec 12, 2019 at 14:43
-
I asked a question very similar to this recently– SomeoneCommented Dec 12, 2019 at 14:45
-
1doing a gdpr request could just slow down the entire process as they might need to take care of that before they take care of the deletion request.– Joe WCommented Dec 12, 2019 at 14:45
-
@Patrice no, the delay is not illegal. I understand that ``` I feel like catering to the needs of people who want to leave the platform is not the kind of important improvements they will want to focus on```, which is why I'm wondering if making a request which does need implementing may give a little push– user5940189Commented Dec 12, 2019 at 14:45
-
@Displayname oh 100% with you there :). I'm just trying to frame the "I expect them to speed up the normal delete process" with the proper expectations ^^. Good luck to get it all wiped :)– PatriceCommented Dec 12, 2019 at 14:46
-
2GDPR recommends 30 days for deletion requests, however, depending on the complexity it can take up to 60 days - in additional [gdpr-info.eu/art-12-gdpr ]– MatthewCommented Dec 12, 2019 at 14:46
-
1@Matthew Up to 90 days, not 60– Nick is tiredCommented Dec 12, 2019 at 15:10
-
also relevant: meta.stackoverflow.com/questions/385403/…– reneCommented Dec 12, 2019 at 15:15
-
@NickA I had meant to say with an additional 60 days, thanks for clarifying.– MatthewCommented Dec 12, 2019 at 16:20
-
GDPR gives you an upper limit. If you fear that the normal process will exceed this limit, do it.– NoDataDumpNoContributionCommented Dec 12, 2019 at 17:02
-
Why are you in such a hurry? It will get deleted. It takes some time as it is not automatic process How long does it take to process an account deletion? If anything GDPR request can slow deletion not make it faster.– Dalija Prasnikar ModCommented Dec 12, 2019 at 22:26
-
@DalijaPrasnikar "If anything GDPR request can slow deletion not make it faster. " Citation needed. GDPR gives an upper limit. If the deletion would usually be slower than the limit set by the GDPR, it might also make it faster (increase the priority).– NoDataDumpNoContributionCommented Dec 13, 2019 at 11:51
-
1@Trilarion Plain logic... deletion is one task, collecting data is additional task. Limit set by GDPR is 30 days. I believe account deletions at SO are much faster than that.– Dalija Prasnikar ModCommented Dec 13, 2019 at 13:21
1 Answer
Doing a GDPR request could end up delaying the process even more as it is likely there are other things involved with it that could end up taking longer.
They are given 30 days for a normal request and it can be extended given the complexity.
"...without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests."
Confirm receipt of the request from the data subject to erase their data with a realistic erasure completion time frame. Nobody likes to be ignored, and responding to the request with a genuine notice of action is only fair. Under Article 12.3 of the GDPR, you have 30 days to provide information on the action your organization will decide to take on a legitimate erasure request. This timeframe can be extended up to 60 days depending on the complexity of the request.
-
"They are given 30 days" as far as I can tell that isn't true. The 30 days count for data request, but not for deletion requests. All the resources/guide lines I found say "no undue delay" without outlining a time-frame. Can you link your source please, would be interesting to read.– TomCommented Dec 12, 2019 at 14:59
-
@Tom The relevant article is 12.3: "...without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests." Commented Dec 12, 2019 at 15:03
-
@NickA That's a rather broad paragraph and it says the scope is from article 15 to 22, but article 17, the article about deletion, denies undue delays. So I wonder if article 17 is exempt there.– TomCommented Dec 12, 2019 at 15:12
-
@Tom It says from 15-22 so 17 is explicitly included, the lack of definition for what constitutes an undue delay isn't relevant (to whether or not it's included, it may be relevant to the question) Commented Dec 12, 2019 at 15:20
-
2GDPR.eu states: "“Undue delay” is considered to be about a month." towards of the end of the first paragraph of What is the right to be forgotten? Commented Dec 12, 2019 at 15:26