The question that pop into my mind is "What about purchase history?"
We run a webshop and sometimes a get customer that demands that we delete all their information. They are entitled to make that demand, but at the same time we're required to store the same information for at least two year, in order to be able to handle returns, and maybe five years due to accounting.
I really do applaud the court for their intentions, but it leaves a lot of unanswered questions and challenges. In our case we would have to make serious changes to our ERP/CRM systems, it currently do not allow deletion of data, because that would be bad for accounting. Also: Can I deny you warrenty because you requested that I delete all data regarding your purchase and person?
You could send them an email containing a digitally signed receipt. If they ask for their data to be deleted and then later want to make a return, they could send you back the email.
While I do like the idea, that not how your average customer work. Don't get me wrong, I love our customers, but here's a short list of weird stuff we seen from them:
* Forget which phone number they used.
* Switch to a email provider and don't transfer emails.
* Delete email 5 seconds after receiving it.
* Enter wrong email address, twice.
* Forget where they live... ?
* Forget order number.
* Give you an order number for a different webshop.
* Call and tell you that you're spamming ( i.e. sending an order confirmation )
Yes, you and I will save an email for two years, the average customer won't.
I think this is more about data that is being displayed publicly. I don't think purchase history falls into that realm, as that is private data that you have a right/responsibility to keep for your webshop's records. Just don't display it publicly, obviously.
Need is quite specific here - I suspect you need something more than Google can offer. E.g. required by legislation as part of running the business would be sufficient.
In our case, based on what is "personal data" in Denmark, we would need to delete: name, address, phonenumber and email, that leaves us with the order number. the problem with that is that now we can't tell if it's the original customer that contacts us for a repair or refund, he could just share the order number with a third party... Yes, people actually try that.
What is the problem? If the customer has a valid receipt, the customer is entitled to have the repair / refund. There must be no difference to buying something in a physical store.
What consists of a "valid receipt" for a digital purchase? An email? A printed copy of an email? Either can be trivially forged if the company has no way of verifying the information.
Usually, when I order something online, I get an receipt via mail and paper (with the shipment). Mail and paper receipt contain order details which can be used to prove the legitimacy. And you can always sign the receipt (plain/text or attachment with the mail, QR code with the paper receipt).
It is important not to delete the order data, but to anonymize the user data. Your shop software should be able to handle this. Otherwise, I would use another product ;)
i really doubt it covers purchase history. I think it covers more about the right to ask a blog/social media to remove your identify from the page. alison stokke would be stoked about this news
We run a webshop and sometimes a get customer that demands that we delete all their information. They are entitled to make that demand, but at the same time we're required to store the same information for at least two year, in order to be able to handle returns, and maybe five years due to accounting.
I really do applaud the court for their intentions, but it leaves a lot of unanswered questions and challenges. In our case we would have to make serious changes to our ERP/CRM systems, it currently do not allow deletion of data, because that would be bad for accounting. Also: Can I deny you warrenty because you requested that I delete all data regarding your purchase and person?