Private company making it hard to delete customer&#39;s personal data Storyline A friend of mine opened an account with an online company that sells picture prints. Without her knowing, just after signing in, somehow (she did not understand how; probably through the Apple application Photos), the company came into possession of the photos she had on her computer. When she realized they were in possession of her photos, she sent an email asking for the account to be closed and her personal data (photos included) to be deleted from their system. It follows a pretty long list of confusing emails at the end of which they agreed to close the account. They did not confirm they would delete the pictures though. Two months later, she received a promotion email that included her pictures! She sent another email asking to stop promotional emails and also asking to delete the pictures. They answered they can't delete the pictures themselves, but they can reopen the account so that she can delete her pictures herself. She accepted it to reopen the account (which was probably an unfortunate move). Turns out, deleting pictures can only be done one at a time and there are thousands of pictures, which is more than inconvenient! That's at this moment that my friend told me the story. Extra information No payment and no banking information has ever been given to this company. Note also, if it matters, that my friend lives in Canada. Question I very much suspect she is in right to 1) no receive promotion emails anymore, 2) Have them close the account again and 3) have them delete her pictures. Am I right? Can you please advise us on an appropriate answer to hopefully convince the company to respect those rights?
I very much suspect she is in right to 1) no receive promotion emails anymore, 2) Have them close the account again and 3) have them delete her pictures. No, she does not have those rights. She agreed to a legally binding contract when she signed up for the service when she clicked "OK" to open the account. That contract outlines her "rights," as you call them, and they can be very different from what you assume to be ethical and moral bounds to a business relationship. What you imagine to be fair business practices could be generally regarded as fair and normal consumer relations; but that's not necessarily what may be in the contract. What she agreed to in the Terms of Service (TOS) could be some form of long term licensing of her photos to the service, and that could be why they won't delete the photos and why she can't delete them in bulk. The TOS states the terms of the promo emails she agreed to receive. Read the TOS; everything will be outlined. The company is in no way obligated to make life easy for her or change the contract to appeal to her; she agreed to everything, including downloading all her photos. If she didn't read the TOS and feels they copied all her photos "without her knowing", that's her fault. It's possible that the company is breaking consumer protection laws with some of their practices, but you'll need to read Canada consumer laws and see if they require ease of use, permanent op-out of emails, etc. I doubt the company would be flagrantly violating consumer law.
I agree with Ben that there are many exemptions to the right to be forgotten. For example if messages are removed from a mailing list archive, the replies to deleted messages will become useless. That would impact the right of freedom of expression and information of those authors. That is one of the exemptions to the right to be forgotten. So there is no right to delete complete messages. Replacing references to names and email addresses, is a very good solution. It must not be possible to de-anomize the data. So having anon-20190213-123@example.org, it must not be possible to get back A. Person &lt;a.person@example.org&gt;. Sure, everyone who received a copy of those messages can find that message in their own archive, and see the author that way. But that is because they simply have a copy of the full archive. The right to be forgotten is independent of someone else having the same information you request to delete. For example google removes search results in its index, even though the same information can still be found on the original website. To fully exercise the right to be forgotten, you have to make a request to everyone who has that data. In Austria there is a recent case (ECLI:AT:DSB:2018:DSB.D123.270.0009.DSB.2018) (available only in German) where someone's data was anonymized after asserting his &quot;right to be forgotten&quot;. He did not agree and wanted his data to be fully deleted, so he filed a complaint at the Austrian DPA. The DPA denied his request. I have tried to make a translation of the relevant part of the judgment, note that many references are to other Austrian judgments or books (where I listed the ISBN instead). D.1 The binding part of the GDPR does not contain the term &quot;anonymisation&quot;. Only recital 26 states that the GDPR does not apply to anonymous data. D.2 The term &quot;erasure of personal data&quot; as used in Art. 17 is neither found in the binding part nor in the recitals. In Art. 4(2) erasure and destruction are listed as alternative forms of processing which are not necessary identical. This means that erasure does not necessarily requires final destruction. (cf. K121.375/0012-DSK/2008, with regard to Directive 95/46/EC, where also a distinction was made between erasure and destruction; cf. ISBN 978-3-406-72006-2). Such a differentiation also results from the case-law of the Constitutional Court (cf. VfSlg. 19.937/2014). Therefore, the person in charge is entitled to make a choice with regard to the means - i.e. the manner in which the data is deleted - (cf. again ISBN 978-3-406-72006-2, according to which reference is made to the destruction of keys or other decryption devices without the removal of the data itself; cf. in this sense also ISBN 978-3-406-71932-5, which refers to the impossibility of perceiving the information previously embodied in the data to be deleted; cf. also ISBN 978-3-406-72007-9, according to which deletion is to be understood as any kind of conceilment of stored personal data; cf. also Warter, Dako 2/2018, 39 [40], according to which the result of the deletion action is decisive). The removal of the personal reference from personal data (&quot;anonymisation&quot;) can thus in principle be a possible means of deletion within the meaning of Art. 4(2) in conjunction with Art. 17(1) GDPR. However, it must be ensured that neither the person responsible himself nor a third party can restore a personal reference without disproportionate effort (cf. RS0125838, according to which it is not sufficient to merely change the data organisation in such a way that &quot;targeted access&quot; is not possible any more; cf. also the judgment of the CJEU of 19 October 2016, C-582/14, 45 ff.). Only if the person responsible aggregates the data in a way that no data can be identified, can the resulting data stock be described as anonymous (i.e. without personal reference) (see Opinion 05/2014 on Anonymisation Techniques of the former Art. 29 Data Protection Working Party, WP216, p. 10). The Administrative Court has also ruled - with regard to the comparable legal situation under the DSG 2000 - that a redaction (blacking out), for example, can be regarded as a form of deletion. By making the name of the data subject and all other data relating to him or her unrecognisable, his or her request for deletion is complied with (cf. the decision of 23 November 2009, 2008/05/0079). So anonymisation is sufficient to comply with a right to be forgotten request.
I am not a lawyer, and none of the following should be seen as legal advice. While it is always best to assume every image has a copyright.... In your scenario... traditionally if you are selling a product, there's generally no harm in using images of that product to assist in the sale. But even then photographer copyrights should be considered. Images of products may not only contain copyrighted material within the photo, but the photo itself is probably also copyrighted by the photographer. Just blankety taking images from other web sites is a poor practice in general and will customarily just get you into trouble. However, many manufacturers or distributors will actually provide resellers with product images. You can check the product manufacturer's web site for a "press" or "media' section. There are often downloads provided in those areas. I don't know hairdressing.. but as an example, General Motors has a special web site known to GM car dealers where the dealers can download high resolution images of the cars and products for ads, etc. I've done work in the past for a GM dealer who provided me with the web site and log in details so I can get product imagery. In addition, few manufacturers will take umbrage that you are using their images to sell their products. They want their products to look as good as possible wherever they may be displayed. In many cases, they may prefer you use supplied images rather than use your own. Customarily you would include a disclaimer in the footer somewhere: The product names, company names and product images used on this web site are for identification purposes only. All trademarks and registered trademarks are the property of their respective owners. Note, I am referring to images from the manufacturer's web site, not from competing businesses. If you are building a site for "Bob's Hair Styling" it's unethical to take images from "Kate's Hair Dressing" for your use. Stick to the manufacturer... if selling Paul Mitchell products, check the Paul Mitchell web site for available product images.
Earlier this year, the Internet lawyer Arnoud Engelfriet wrote a blog post about exactly this topic. As it is written in Dutch, I will summarize it here: As you also said, deleting posts breaks the flow of the archived conversation and it makes your archive incomplete. This is a problem for the freedom of expression and information. But Art. 17(3) GDPR includes an exception to the right of erasure for this situation. So posts do not need to be deleted. However, profiles are not included in this exception. So they must be removed, but they can be pseudonymized. For example replace the username with user89432, and remove all details from the profile. If other posts contain the nick of the author of an anonymized post, that is considered an journalistic, academic artistic or literary expression, so Art. 85 GDPR would apply, so the right of erasure does not apply to that. Bottom line: you only have to pseudonymize the account, if that person wants to be removed from the forum.
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.
The first thing that has to be done (in court, or via lawyer-to-lawyer communication) is that The Company has to prove that they own the copyright. If they accomplish that, you can defend yourself by providing proof of a license to download and redistribute. From what I can tell, you cannot directly prove that, since the rights-holder did not give you the license. The issue is that a third party cannot impose a license on a work simply by putting it out there with a file that claims to be a license from the artist. So this brings in the Free Music Archive: they presumably have some evidence that the rights holder did indeed grant the alleged license, and may be able to provide proof. Your argument may be credible, in the sense that you had a good-faith belief that the item was so licensed, and the website would provide a basis for concluding that that belief is reasonable. If the work was licensed, then the some rights holder would know that, but not necessarily the current one. Assume the artist made a recording, transferred the rights to Company A, who later sold the rights to Company B who is now coming after you. Artist may have licensed it when it was his, and forgot to tell A. A may have licensed it when they sold the license to B. Artist may have improperly licensed it after he sold the work to A (under the "I wrote it, I have the right to do whatever I want" non-legal theory). A might have improperly licensed the work after selling the right to B (maybe by mistakenly including it in a package deal, i.e. via bookkeeping error, rather than ignorance of the law). Or, they may simply have forgotten. If this is a DMCA takedown notice, the notice-giver could just be abusing the system. But we don't know how you were contacted, so I'll leave DMCA out of this for now.
Is the question just whether a company can contact its customers to ensure that they're happy with the company's services? If so, the answer is generally yes. I can think of no reason why this would change based on the fact that someone saw her using the services of a competitor. Your mother seems to be treating the phone call as an accusation, but it appears to be standard customer-relationship maintenance. If she chooses to approach it differently, she can use it to improve her bargaining power with Gym 1.
The question of whether a person was acting on their own behalf or that of a company would generally be a question of fact, so if such a case came to court it would be for both sides to present evidence and argue for their interpretation of it. In most cases the context makes it clear. You mention having a company email domain and associated email signature; that is certainly good practice and would go a long way towards creating a presumption that you were acting for a company. Also signing yourself with your job title or role (e.g. "Joe Bloggs, Chief Bottlewasher") makes it clear that you are speaking in your role as an employee. The content of the communication also matters; if you use your company email address to order goods from a supplier that the company has used before then the recipient can reasonably assume that you are ordering on behalf of the company and a court is likely to agree. OTOH if you use the company address to send libellous emails then the recipient would have a much higher bar to claim that this was the company view rather than a personal one.