Slashdot Mirror
Deleting Personal Data from Private Institutions?
An anonymous reader asks: "This site has many readers who are familiar with the liabilities of personal data being stored on servers owned by private institutions. Bank records, phone records, credit records, flight records, basically any type of digital transaction can be (and likely are) stored indefinitely for whatever reason. Are there processes by which one can request a removal of personal data, or by signing contracts with these companies, do they own the rights to the information? If you have attempted such an erasure, have you encountered resistance?"
with the passage of Sarbanes-Oxley. Might be harder than ever to get them to do it, since they could face prison time for violating the act.
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
Just file for copyright of all personal information pertaining to yourself, and when a problem arises, simply file a DMCA violation complaint against them.
:)
HAHA that would totally fsck up the SarBox rules
Support NYCountryLawyer RIAA vs People
Back when amazon.com was a new company struggling to get customers, they said they would never share your personal information with anyone -- and then a few years later stabbed everyone in the back by reversing this policy. At that time, I did not want to be their customer anymore and wanted my customer data expunged. I was told that there was no way to stop being a customer and have historical information purged.
I'd guess that even if you did get someone at a company to state that your personal information had been expunged, there's a very high probability that nothing was actually done and that all of your information was still there. This is purely based on my experience with various levels of customer service and managers--they'll tell you what you want to hear just to make you go away.
This guy's the limit!
Well, here in Belgium it's simple. There's a law that gives you the right to request all info they have on you, and allows you to order them to delete it. I'm not 100% sure, but I think at least a few other European counties have a law like that.
Computers are useless. They can only give you answers. -- Pablo Picasso
Some registration systems offer the patient the option of masking personal data, but it's still sent off to various vendors and ancillary systems during the course of treatment. Along the way it's cached, stored in databases and printed ... and it's not uncommon for the data to find its way into files that fail to be deleted. I've seen dump/bug check files and other temp files containing personal information. Lord knows what forensic tools could uncover.
So my answer would be no, given current architectures and system implementation methods.
I know, this is worse with all of the personal data that firms have, and many times, they were collected some other way other than the customer giving it to them.
For example, I once switched over to Sprint telephone service. When I canceled, they wanted my SSN. I said, "That's funny, I never gave it to you." Long story short, they had it allright! They "needed" it so that they could cancel my service.
My only guess is that the credit bureaus are pimping our data - ALL of our data! don't get me started on ChoicePoint!!!
The only way to be sure is not to give out information in the first place and simply pay for things with cash (Wikipedia entry for "Cash" for those of you who are unfamiliar with it).
Really, it's a trade off for using services in our modern culture. The thing is that nobody is forcing you to give away any of your information.
It is possible to keep your data private, if you so choose. My home address, in fact, is in no databases except for my power company, and I receive -zero- mail there, which is, as far as I can tell, the only way to be sure that that particular data isn't floating around out there.
Suppose you're running a one-person business and one of your customers is obnoxious to you. Should you be required to forget all about it and treat them as any new customer next time you see them? Requiring businesses to delete records about their customers is essentially enforced amnesia. Whenever there's a transaction, it seems pretty reasonable for both sides to remember what happened.
And then there's the question not only of what you should remember but who should you tell. If you have a bad experience as a customer, most people would feel perfectly justified in telling their friends, posting to their blog, and engaging in other bad publicity towards the company. When a business gets ripped off, who are they allowed to tell? Should assholes and deadbeats get a free pass next time?
The other side to this is that we've grown accustomed to a certain amount of anonymity when dealing with larger businesses. This is a sort of automatic forgiveness. Some kind of forgiveness is essential, because memories are fallible, records can be wrong, and people change. Not to mention that there's an enormous power imbalance when you're dealing with a big business. But the question of how long you should remember, what you should forgive and forget, and how that should affect peoples' reputations doesn't have simple answers.
In the UK, all you need to do is write to the company in question and tell them you want the data deleted. Thanks to the Data Protection Act, they must then comply.
You can also ask for a copy of all data held about you, although in that case the company is entitled to a "reasonable" fee (usually £10) to cover admin costs.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
...you don't own your home or your landlord has never run your credit--for that matter you have no credit (good luck owning a home then)--you're not employed, don't pay taxes, don't vote, have never been cited for any infraction of law (much less anything worse or actively sued or been sued for anything), don't drive, have no insurance of any kind, do not have a passport, have never sought medical care. Even after that, the POSTAL SERVICE certainly has your address and THEY certainly give that out as a matter of course.
Yes, SOME databases are best avoided (say, spammers, unnecessary creditors and sweepstakes operations), but to attempt to be in NO databases...well, that becomes an exercise in pointless histrionics.