Companies Delete Data Instead of Providing Access, Report Finds

A journalist's investigation into data privacy practices revealed significant challenges in exercising consumer rights under the California Consumer Privacy Act (CCPA). When attempting to access personal data from over 100 companies, the journalist encountered widespread confusion, errors, and outright refusals to comply with access requests. In several instances, companies mistakenly deleted the requested data instead of providing it, despite explicit instructions not to do so.

One notable case involved Crunchbase, which permanently deleted the journalist's account after receiving an access request. A spokesperson attributed this to a "processing error." Similarly, BeenVerified initially responded to an access request by stating that the user's report had already been removed, later citing issues with identity verification. Cash App also presented difficulties, with phone support agents seemingly unable to process access requests as outlined in the company's privacy policy.

Consumer advocates expressed dismay at these findings. Ben Winters of the Consumer Federation of America called the situation "crazy" and "not an acceptable status quo," highlighting the weaknesses in privacy frameworks that depend on companies acting in good faith. Elina van Kempen, an academic researcher, shared similar experiences of data brokers misclassifying access requests as deletion or opt-out requests.

BeenVerified's senior director of compliance, Greg Hammond, acknowledged that an agent misunderstood the request type and stated the company would provide refresher training and audit recent work. The journalist also noted using generative AI for drafting bureaucratic emails and updating a tracking spreadsheet for the report, while the main body of the article was written by hand.