Can a EU company legally refuse to delete U.S. customer's data w/o ID?

March 6, 2016 10:38 AM

Can a EU company legally refuse to delete U.S. customer's data unless the customer's U.S.-based passport/identification is sent overseas to that foreign entity within the EU? I am aware the data pact protects this only in reverse, but that doesn't help me as I am a U.S. citizen.
posted by Grease to Law & Government (4 answers total)

Response by poster: Specifically, if the Terms of Service to which I have agreed when I've joined did not state the right to hold that data unless passport is sent to said foreign entity, and I have not yet accepted the new Terms of Service?
posted by Grease at 10:50 AM on March 6, 2016

Each EU country has their own version of the Data Protection Act, so it's going to depend on where you are talking about.
posted by threetwentytwo at 11:01 AM on March 6, 2016

Response by poster: United Kingdom.
posted by Grease at 11:04 AM on March 6, 2016

Best answer: OK, well there isn't specifically any right to require them to delete information (not without taking it to court for damage and distress, anyhow). They can't retain it for longer than they need it, but that means that they can hold it for a fairly long time in most circumstances. As such, there's nothing stopping them from asking you for ID in order to delete it.
posted by threetwentytwo at 11:17 AM on March 6, 2016