Monday, April 11, 2016

The right to delete your own data

There's another version of this essay at my Coaching Buttons blog, also titled The right to delete your own data.
We have more protection for your credit card data than the information someone can use to set up a fake credit card in your name.

If you do anything online, your data is at risk. Always. Every time you open an account somewhere, you provide a bunch of personal information. Some sites don't ask for much more than an email address and a password. Other sites require more data about you. And other sites don't require many details to get started, but you add more anyway.

But websites get hacked all the time. And when they do, your data gets spilled out for any hacker to pick up and use to impersonate you online, or to leverage in an attack against more secure websites, such as your online banking. You are using a different password for every website, aren't you?

Think you're immune? You aren't. I'll bet if you search for your email address (like you'd use as a website login) at the Have I Been Pwned? website, you'll find your data has been breached somewhere.

Do you want your personal data out there if that website is breached? If you can delete your own account when you stop using it, then you can minimize your risk if the website is attacked. If you can't delete your own data, you can only hope the website doesn't get breached.

So it's very important that when you choose to leave a website, you must be able to delete your account. This is a data privacy issue.

When I left higher ed for a new position in local government, I started deleting any online accounts I didn't need anymore. Every week, I would login to another old account and try to delete it. Many websites have a "Delete my account" option right there, so you can choose to immediately delete your account. Other websites require you to work through their IT Support folks, who usually are happy to delete your account after first verifying who you are.

But not every website was that happy to let me leave. Some outright refuse to let me delete my own account there.

The website that's causing me the biggest headache is Educational Testing Service (ETS), the people who run the Graduate Record Examination (GRE) when you apply to graduate school. They also manage other exams. I took the GRE in late 2011 before I entered my Master's program in Spring 2012. As far as I know, I haven't accessed my account since then—until now, anyway. After finding no option to remove my own account, I contacted ETS in March 2016 (four years after I stopped accessing my account) to request they delete my account for me. I received this reply:
Thanks for your message! Unfortunately the MY GRE Account can not be deleted. Please note, it will drop out of the system as long as there is no access with the account.
Ironically, I'm also unable to delete my account at the White House petitions website. The "Contact Us" folks won't even return my queries. Thanks, Obama!

It's disturbing to me that some websites make it impossible to remove my account. While I can understand that some systems are just not set up to accommodate deleted accounts (Wikia tracks edits by account, for example) at least most websites don't actually store personal information. But some websites do keep personal information about you, and they don't let you delete your account or remove (or edit) your own personal data after it's in the system. This should be a large concern for anyone these days.

It's unsettling to have an account out there that I cannot remove. Especially one like ETS, which by its nature needs to know several personally identifying details about you so they can verify your identity for any exams you take through them. If the ETS website is ever hacked, my personal information is out there. As will be thousands of other users who have taken the GRE or other exams.

We need the right to delete your own data. It's your data. We need the right to manage and protect our personal information online.

We can change this. But I need your help!

I'm planning to reach out to U.S. Senator Franken (my Senator) on this issue. I think it's something worth fighting for. Please support me!
If you live in Minnesota, please contact Senator Franken's office (phone or email) and ask him to support the right to delete your own data. You can also tweet to him via @alfranken.

If you live elsewhere, I encourage you to reach out to your own Senator and ask that they support the right to delete your own data. Feel free to use the reasons I've shared here.

If you are on Facebook, I recently started a Right to delete Facebook group about this issue. Please join and share the Facebook group.
You can also support me by sharing, Tweeting, Facebooking, and reblogging this article. Post this on Reddit, put it on Slashdot, share it with your local news.
image: Sammynetbook (cc-by)

1 comment:

  1. Nice post ! thanks for sharing such useful content,