Deleting Personal Data from Private Institutions?

An anonymous reader asks: "This site has many readers who are familiar with the liabilities of personal data being stored on servers owned by private institutions. Bank records, phone records, credit records, flight records, basically any type of digital transaction can be (and likely are) stored indefinitely for whatever reason. Are there processes by which one can request a removal of personal data, or by signing contracts with these companies, do they own the rights to the information? If you have attempted such an erasure, have you encountered resistance?"

Comments

Amazon.com won't...

[scottsk]

Back when amazon.com was a new company struggling to get customers, they said they would never share your personal information with anyone -- and then a few years later stabbed everyone in the back by reversing this policy. At that time, I did not want to be their customer anymore and wanted my customer data expunged. I was told that there was no way to stop being a customer and have historical information purged.

Re:Amazon.com won't...

[Reality Master 101]

I just get into the online form for the company in question and enter crazy trash into all the blanks. Afterwards, all they have is junk that has nothing to do with me. The likelihood that anyone searches the backups is nil.

That's assuming they don't keep easy-accessible audit trails and change logs for all of the fields. All of my e-commerce systems do. It's actually kind of funny when people change their information to garbage to keep us from tracking them when they bounce payments or something like that.

In Europe

[MeltUp]

Well, here in Belgium it's simple. There's a law that gives you the right to request all info they have on you, and allows you to order them to delete it. I'm not 100% sure, but I think at least a few other European counties have a law like that.

Re:In Europe

[Wally4u]

The dutch privacy act give room for this. http://home.planet.nl/~privacy1/wbp_en_rev.htm You can demand you personal data to be destroyed except when it has a specific purpose (ie bank records, police records etc). If they fail to do so, or sell the data without written consent they can be fined.

Data Protection Act

[AmiMoJo]

In the UK, all you need to do is write to the company in question and tell them you want the data deleted. Thanks to the Data Protection Act, they must then comply.

You can also ask for a copy of all data held about you, although in that case the company is entitled to a "reasonable" fee (usually £10) to cover admin costs.

Re:Data Protection Act

[ajs318]

But the UK Data Protection Act assigns a "rightful purpose" to the data they are storing about you, and anything other than that rightful purpose (including internal systems testing, technically!) is a misuse -- which is a breach of the Act. If you've asked them to remove your data then it now has no rightful purpose, so anything they do with it from then on is in breach of the Act.

Note that at least until not long ago, data stored by non-computerised means was exempt from any legal protection whatsoever. There was at lease one organisation which used this loophole to their advantage, and held much information on "Undesirables" (such as dope smokers, trade unionists, people who donated to Amnesty International, people seen wearing a Levellers t-shirt ..... that kind of Undesirable) on paper in filing cabinets. And there was nothing anyone could do about it. I'm not sure if the 1998 amendments sought to block this.