ezl

Sometimes site users email and ask for "all their information to be removed from the site". This comes in various forms, from "please deactivate my account" (easy) to "Remove all of my information COMPLETELY from your systems" (maybe not so easy).

What are recommended approaches for dealing with this?

I'm assuming that "soft deletion" isn't actually "removing information completely", but trying to engage consumers in that conversation isn't productive.

Also note that if destroying data is on the table, that deleting one person's records may necessarily destroy another person's (for example, in-site communication between 2 users).

Considerations:

1. Feasibility: What does this mean? I think some users may mean "scrub traces of my access from your logs, delete database records (and possibly from backups)".

2. Legal/Ethical concerns: What, if any, legal concerns are there with this? What, if any, are the ethical considerations surrounding this type of request?

3. Obligation: What obligation or responsibility does a site have to abide by these sorts of requests, if they are feasible?

4. Recommended practices: Independent of how feasible it is, what the legal or ethical responsibility is, whether such an obligation reasonably exists -- what are some of the ways that people deal with (or recommend dealing with) these types of requests?