Deleting Personal Data from Private Institutions? 103
An anonymous reader asks: "This site has many readers who are familiar with the liabilities of personal data being stored on servers owned by private institutions. Bank records, phone records, credit records, flight records, basically any type of digital transaction can be (and likely are) stored indefinitely for whatever reason. Are there processes by which one can request a removal of personal data, or by signing contracts with these companies, do they own the rights to the information? If you have attempted such an erasure, have you encountered resistance?"
The rules have changed (Score:5, Interesting)
Sounds easy enough to me... (Score:4, Funny)
HAHA that would totally fsck up the SarBox rules
Re: (Score:1)
So that's why textbooks are so expensive?
Re: (Score:1)
its so stupid it might work, any lawyers in the house????
Re: (Score:2, Funny)
Re: (Score:2, Interesting)
Rage against the Machine! (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Amazon.com won't... (Score:5, Informative)
Neither will PayPal/eBay (Score:2)
-bZj
Re:Amazon.com won't... (Score:4, Interesting)
Re:Amazon.com won't... (Score:5, Informative)
I just get into the online form for the company in question and enter crazy trash into all the blanks. Afterwards, all they have is junk that has nothing to do with me. The likelihood that anyone searches the backups is nil.
That's assuming they don't keep easy-accessible audit trails and change logs for all of the fields. All of my e-commerce systems do. It's actually kind of funny when people change their information to garbage to keep us from tracking them when they bounce payments or something like that.
Re: (Score:3, Insightful)
Do you bother to look through the audit trail when they haven't bounced a payment or done anything dodgy like that? The original poster's stated intent wasn't to cheat anybody, after all.
Re:Amazon.com won't... (Score:5, Interesting)
Do you bother to look through the audit trail when they haven't bounced a payment or done anything dodgy like that? The original poster's stated intent wasn't to cheat anybody, after all.
There's an automated system that tracks new customers against all the old data in order to identify people who've cheated the company in the past. So it depends on what you define as "bother to look through". If I was going to create a marketing list for whatever reason, I might use the old data, but who knows what other people do with stuff like this. My point is only that any semi-competent company is going to have a policy of "never throw away data", especially if it's customer changeable.
Re: (Score:3, Insightful)
This is only valid when data storage is inexpensive enough for you to to allocate magnetic media to store said data.
While the NSA has (probably) been doing this for years, and Wal-Mart and MasterCard/Visa for about 15 years, it's only been broadly feasible since the introduction of inexpensive 100GB hard drives. Even now, we only keep tape archives for 7 years.
Note t
Re: (Score:3, Interesting)
This is only valid when data storage is inexpensive enough for you to to allocate magnetic media to store said data.
Eh, it's not as hard (or as storage-consuming) as you might think. I developed a medical system in the early 90s that kept a history of all changes. The fact is that usually one gets new data much faster than old data changes. It depends on the application, of course, but that's been my experience. Of course, I only store what actually changes, I don't clone entire records.
Re: (Score:2)
With the Sun Fire X4500 [sun.com], a 4U server that holds 24 drives, your estimate is exactly right. However, even with 1TB drives, you have to account for redundancy and other overhead (such as database indexes), so the total usable space is probably less than half that. Fitting a 100TB data warehouse into one rack seems feasible in the near future.
Storage services such as Amazon's S3 [amazon.com] mak
Re: (Score:2)
Doh! I feel so ashamed. Pardon me while I go into the other room and self-flagellate.
Re: (Score:2)
just a hunch (Score:5, Insightful)
Re:just a hunch (Score:5, Insightful)
Never take their word for it.
Re: (Score:3, Insightful)
Which is why you _always_ insist on written confirmation.
Never take their word for it.
How is their written word any more reliable then their spoken one? Is the paper dipped in truth serum?
Sure companies are more reluctant to lie in writing, but short of a data thief documenting the act of stealing your data from them, there is little chance of getting caught.
Re: (Score:3, Informative)
When it's in writing it becomes legally binding and can be used in court as evidence should you ever need to go down that path. If it's not in writing then it's just your word against theirs.
This is a fundamental thing to understand about business, and I would say a fundamental life lesson. If it's not in writing, it means nothing. Never take someone's word on something, particularly if it's regarding something that's important to you. Wh
In Europe (Score:5, Informative)
Re:In Europe (Score:4, Informative)
Re: (Score:2)
Re: (Score:1)
Most do. Off course some don't, especially as it's not easy to know. But even if they keep the data, they at least leave you alone. If not, they'll give you proof you can use to sue. And before you laugh again, courts DO occasionally get it right :P
Off course not, there's a lot of problems, but it's not nearly as bleak as you make it appear. Not every law is out to get y
In France, regulated since 1978 (Score:2)
Requiring a company to delete all your data is defined in this law.
The Commission Informatique et Libertés [wikipedia.org] is a administrative authority that was created by this law and whose mission is to ensure that data privacy law is applied to the collection, storage, and use of personal data.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
2. Onder "verwerking" wordt verstaan elke bewerking of elk geheel van bewerkingen met betrekking tot persoonsgegevens, al dan niet uitgevoerd met behulp van geautomatiseerde procédés, zoals het verzamelen, vastleggen, ordenen, bewaren, bijwerken, wijzigen, opvragen, raadplegen, gebruiken, verstrekken door middel van doorzending, verspreiden o
I know in health IT the data is everywhere (Score:5, Interesting)
So my answer would be no, given current architectures and system implementation methods.
Re: (Score:2)
And yet somehow I have to fill out forms with my birth
A Guy sued over being on a mailing list... (Score:5, Insightful)
I know, this is worse with all of the personal data that firms have, and many times, they were collected some other way other than the customer giving it to them.
For example, I once switched over to Sprint telephone service. When I canceled, they wanted my SSN. I said, "That's funny, I never gave it to you." Long story short, they had it allright! They "needed" it so that they could cancel my service.
My only guess is that the credit bureaus are pimping our data - ALL of our data! don't get me started on ChoicePoint!!!
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
I set it up before I had an SSN, and got a letter for the bank a while later about having a month to give them one or they will have to close the account. It was a couple of years ago now, so I don't have the letter to check what regulation they referenced or if it was a real requirement or just something they tacked on themselves to make their lives easier...
Re: (Score:1)
Look Here [privacyrights.org] for who can ask for SSN and what it is used for. To save you some time:
"Why do financial transactions require my Social Security number?
In 1961 the Internal Revenue Service began using Social Security numbers as taxpayer ID numbers (TIN). Therefore, SSNs are required on records of transactions in which the IRS is interested. That includes most banking, stock market, property or other financial transacti
Re: (Score:2)
What I'm saying is that they did require my SSN - it was "give it to us or we close the account" a few weeks later - which was fine with me, when I opened the account I'd applied for an SSN already, I just wanted to be able to wire some money sitting back in Australia to myself and wanted to eat before the wheels of bureaucracy finished turning.
Re: (Score:2)
Re: (Score:1)
This is illegal (Score:1)
The other possibility is your identity has been stolen. Might want to look into that, as it is much more likely the cause of your experience, rather than banks openly flouting federal law.
Good luck!
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
With the first set of cards, I noticed a new account on the online system first and called them and told them to cancel that, and if it ever happened again I would leave. The second set of cards
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Calls bank. "We re-evaluated your credit limit." (As is their right, sure, but wait for the punchlines.)
"Your new limit is $6,000." Sure enough, there on her next statement was a notification that this occurred. This was right under the "Over limit charge" of $35 (IIRC) for being over her new limit.
Good scam. "Hey, reduce that customers lim
Re: (Score:3, Insightful)
I remember about five years back when I was running credit reports for applicants. Even though the policy of the company was to require all of the blanks filled in on their application, the software we then entered that data into would pull the credit report of the individual even without us filling in all the gaps. The system would let us put in enough information to sufficiently identify someone (like a name and address),
Re: (Score:2)
I found out the hard way that credit bureaus do not use your Social Security number to identify you by default. They use your first and last name, together with your address history -- all the places you've ever lived -- and the match doesn't have to be exact.
If you happen to be a "Junior" and your credit history shows that you lived at the same address as your father ("Senior"), you really need to know this, because there's a good chance that your credit histories will become confused.
You can call and
The only way to be sure... (Score:3, Interesting)
Really, it's a trade off for using services in our modern culture. The thing is that nobody is forcing you to give away any of your information.
It is possible to keep your data private, if you so choose. My home address, in fact, is in no databases except for my power company, and I receive -zero- mail there, which is, as far as I can tell, the only way to be sure that that particular data isn't floating around out there.
Re:The only way to be sure... (Score:4, Insightful)
This is technically true, but useless in practice.
Nobody forces you to cash a checks, but try caching one without being a registered customer or handing over your full personalia for registration. Nobody forces you to drive a car, but try getting car insurance without giving up your SSN and other private data.
Or try getting a job, but refuse to give out your social security number. Chances are you won't get a job, and will end up on the street. You won't get welfare, because that requires registration of your personalia.
In reality, not handing over your information is impossible, unless you live on a reservation or Amish society.
--
*Art
Re: (Score:2)
Well, in that particular case it's one of only 2 times you should have to give out that number. Once to contribute to social security, and once to withdraw. It makes sense a job requires it since the government requires it of the employer.
Re: (Score:2)
Now SSN and a JOB is because of tax law. Now with you form a S-Corp, then hire yourself, the SSN in internal to you. The other company pays your company, so NO SSN there either.
My kids are now in school, without their SSN. I go to doctors again without a SSN.
May be you just have not tried to keep your information personal.
Re: (Score:1)
Re: (Score:2)
Do you have a drivers license?
Provided... (Score:3, Insightful)
Asking for deletion probably makes things worse (Score:2)
Re: (Score:2)
It's not that simple (Score:3, Insightful)
And then there's the question not only of what you should remember but who should you tell. If you have a bad experience as a customer, most people would feel perfectly justified in telling their friends, posting to their blog, and engaging in other bad publicity towards the company. When a business gets ripped off, who are they allowed to tell? Should assholes and deadbeats get a free pass next time?
The other side to this is that we've grown accustomed to a certain amount of anonymity when dealing with larger businesses. This is a sort of automatic forgiveness. Some kind of forgiveness is essential, because memories are fallible, records can be wrong, and people change. Not to mention that there's an enormous power imbalance when you're dealing with a big business. But the question of how long you should remember, what you should forgive and forget, and how that should affect peoples' reputations doesn't have simple answers.
Re: (Score:2)
keep a seperate deadbeats database of former customers you no longer want to do business with.
Re: (Score:1)
Yes, because it's wrong to punish the vast majority of customers, who are honest, for the wrongful actions of a few.
Requiring businesses to delete records about their customers is essentially enforced amnesia.
Exactly. That's what it's supposed to be.
Whenever there's a transaction, it seems pretty reasonable for bo
Data Protection Act (Score:4, Informative)
You can also ask for a copy of all data held about you, although in that case the company is entitled to a "reasonable" fee (usually £10) to cover admin costs.
Re: (Score:2, Informative)
Many 'law' firms on the Internet have it wrong when they are suggesting deletion on request i
Re: (Score:2)
Parties storing data are required to correct it if it is wrong. If they do not comply, you can take them to court. As for having data removed, you will note that data is generally not supposed to be stored beyond the point where it is required to complete some kind of contract, or legally required to be held. Thus, if you cut all ties with a company and make it clear that they have no reason to keep your data any more,
Re: (Score:1)
Re:Data Protection Act (Score:4, Informative)
Note that at least until not long ago, data stored by non-computerised means was exempt from any legal protection whatsoever. There was at lease one organisation which used this loophole to their advantage, and held much information on "Undesirables" (such as dope smokers, trade unionists, people who donated to Amnesty International, people seen wearing a Levellers t-shirt
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Junkbusters (Score:2)
They also have a lot of good information for dealing with the DMA and others.
The Question is Ownership (Score:2)
Re: (Score:2)
Two requirements: First, tell me who the hell you are
Not likely to happen... (Score:2)
Doesn't mean they'll get rid of it... (Score:2)
My company recently bought a handful of off-lease refurb machines from a major brand distributor (the OEM). They were marked cleaned, and sanitized, and sent to us without an operating system. Or, atleast, that's what we'd ordered.
Imagine my level of surprise when I found LIVE DATA on the only machine I've unpacked so far. These are off-lease, and came from a company that's folded, but the
want them to leave you alone? (Score:1)
Canada rules (Score:1)
Canadian law controls this though PIPEDA
Please refer to Personal
Information Protection and Electronic Documents Act (PIPEDA) for further information.