[lacker]

Isn't that how it should work?

If you write the police and ask them to delete all their data about you, that isn't a thing that they do. It shouldn't matter if the police store their data on AWS or their own servers.

Flock is a tool used by the police so it should work the same way.

[nerevarthelame]

You're right are exemptions for both GDPR [0] and the CCPA [1] where organizations aren't obligated to comply with erasure requests if it would limit their ability to prevent or investigate crimes, fraud, or similar matters.

But that's not what Flock is claiming. They're claiming that they don't even have to consider the request because they don't own the data.

[0] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

[1] https://www.clarip.com/data-privacy/ccpa-erasure-exemptions/