Hacker News new | ask | show | jobs
by joshuakelly 2028 days ago
In general, the consumer data privacy laws in regions where Google has significant regulatory exposure do not permit indefinite data retention of PII. My speculation is that Google sees an across the board, 2-year inactivity period as the best option to mitigate regulatory exposure because a plain reading of, for example, Rec. 39 is that a maximum retention period must be defined as a policy organizationally.
1 comments

This is a weird interpretation of privacy law and makes no sense to me. If I upload a file to Google Drive I expect them to be there as long as I don't delete the file. You could argue, that emptying the bin after 30 days would be needed to fulfill those requirements. But having an inactive account shouldn't. These privacy laws mostly deals with all the other data Google is collecting about its users while they are using the service.