Is this even legal? Hiding data deletion behind login (after email request)
Is this even legal? Hiding data deletion behind login (after email request)
I wanted to delete my old oppo id account, and to do that I'll need to login into it, but I don't know the password.
Password reset requires saying when the account was created (month and year) and "tech support" can't help here either.
Is it legal to block / hide account deletion behind login in European countries? GDPR (and polish RODO) both talk about a right to data deletion, which in this case, I believe, isn't respected.
it's not illegal to put account deletion behind a login at all. Its also legal for them to request identification.
However if you request data deletion and they have no valid exception to avoid doing that they must comply, it doesn't matter if they have a mechanism for deletion that you can use, they have to still delete the data even if you don't press the "delete account" button.
you can file a complaint with your countries regulatory departments but if they refuse to press the delete account button for you, there's not much else you can do outside of that.
Not the answer I was hoping for, but still a good one. I'll try contacting someone who might be interested in this.
In the mean time I sent them another email specifically mentioning this as a request and not me just asking for help.
It has already been said but the company is complying in the sense that it is providing a solution whereby you can delete your account. That said, where you are unable to follow that process, they should offer you the same ability via email. Each company does things slightly differently but I would hazard a guess that an email stating that you find it more reasonable for the action to be carried out via email, they would be likely to comply.
The reasons why companies put these in place is simply to avoid mass requests for deletion and, as stated, to also protect you.
While email spoofing has been mentioned, it is somewhat unlikely anyone would send a request for deletion after spoofing your email, yet, it is not impossible.
You may have to be persistent, could use services that support or even get some pointers from the ICO. Here is a really good link https://ico.org.uk/for-the-public/your-right-to-get-your-data-deleted/
I wish you luck
Yes because they need to verify that its your account and not someone wanting to get your account deleted
As mentioned in another reply:
I'm writing from the email associated with the account, this is enough for most services I encountered
Yes but having you to log in with a password is legit as well.
The fact that the support can't help etc is another issue, completely idiotic.
saying when the account was created (month and year)
This is an absurd requirement, but do you have a ballpark idea, and does it let you continue to guess multiple times? Submit a few dozen password reset requests and if they complain, tell them to verify you via alternate means.
It allows 3 guesses, but I don't know how often they reset. I'm pretty sure the account was created after September 2019, but that's still a lot of possibilities.
Did you tell them that you don't have access to your account? Because to me, this reads like the default answer ("here's how you do it yourself"), not like they won't do it by email if asked to do so.
My company does the same - if you ask our support how to delete the data, they will send you a link to the customer portal. Only if you tell them that doesn't work for you, they will work out another way.
We built the feature into the customer portal, so we want people to use it if possible. Because that's way less work for our support team.
First I wrote on live chat support. After they couldn't help me, I sent the email.
...and it's not the email alone I'm mad at (maybe a little) but the overall experience I had with them. After explaining my issue I was told multiple times they couldn't do anything and the best suggestion I got was "you could create another account", that's not helpful. What am I supposed to do, just leave the old one to die slowly and forgotten?
Password reset requires saying when the account was created (month and year) and "tech support" can't help here either.
Did you try the date of their first email?
If only I had that. It's not reasonable to assume someone would know that or will hold onto emails about account creation.
Thanks nevertheless.
knowing when an account is created, down to the month and year seems to me to be an unrealistic requirement for a password reset.
i wouldn't know the answer to that for any account, anywhere.
I don't think so. I never delete such emails. Why would I? Not like it's in the way