Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
I wanted to delete my old oppo id account, and to do that I'll need to login into it, but I don't know the password.
Password reset requires saying when the account was created (month and year) and "tech support" can't help here either.
Is it legal to block / hide account deletion behind login in European countries? GDPR (and polish RODO) both talk about a right to data deletion, which in this case, I believe, isn't respected.
What would prevent someone else from requesting the deletion of your account if there was no proof that you are the person whose account it is?
I'm writing from the email associated with the account, this is enough for most services I encountered
Emails can be spoofed.
But spoofing doesn't allow a 2 way conversation. Confirming the email should be enough
That's just how it is. If you try hard enough everything can be spoofed. You can also try guessing someone's password and creation date of an account. This is not the issue here.
The issue is with support not giving you an adequate account recovery method, they're correct about validating ownership of the account tho.
Email (on domains without DKIM and SPF at least) can be spoofed so easily, you could literally do it with on-board tools and a few lines of typing though. It is literally just sending an email that has your email address in the From header.
What are the odds that OP is emailing from an email that's not configured correctly? Very low.
If you mean from a domain without DKIM and SPF on the sending domain and DKIM and SPF validation on the receiving one? Pretty high.
Not really since Microsoft, Yahoo (I guess), and Google dominate the email space really hard.
In terms of domains not really. Only the free-mailers use domains by one of those. The corporate users still need to set up their DNS properly for those technologies even if they use one of them as a mail hoster.
Why would OP contact OPPO using a corporate email?
It's extremely likely that they don't have their own domain since it's very uncommon for personal usage. Some absolutely do but they are in the minority.
Of course custom emails need to be set up properly, otherwise all mails would just go to spam.
it's not illegal to put account deletion behind a login at all. Its also legal for them to request identification.
However if you request data deletion and they have no valid exception to avoid doing that they must comply, it doesn't matter if they have a mechanism for deletion that you can use, they have to still delete the data even if you don't press the "delete account" button.
you can file a complaint with your countries regulatory departments but if they refuse to press the delete account button for you, there's not much else you can do outside of that.
Not the answer I was hoping for, but still a good one. I'll try contacting someone who might be interested in this.
In the mean time I sent them another email specifically mentioning this as a request and not me just asking for help.
It has already been said but the company is complying in the sense that it is providing a solution whereby you can delete your account. That said, where you are unable to follow that process, they should offer you the same ability via email. Each company does things slightly differently but I would hazard a guess that an email stating that you find it more reasonable for the action to be carried out via email, they would be likely to comply.
The reasons why companies put these in place is simply to avoid mass requests for deletion and, as stated, to also protect you.
While email spoofing has been mentioned, it is somewhat unlikely anyone would send a request for deletion after spoofing your email, yet, it is not impossible.
You may have to be persistent, could use services that support or even get some pointers from the ICO. Here is a really good link https://ico.org.uk/for-the-public/your-right-to-get-your-data-deleted/
I wish you luck
saying when the account was created (month and year)
This is an absurd requirement, but do you have a ballpark idea, and does it let you continue to guess multiple times? Submit a few dozen password reset requests and if they complain, tell them to verify you via alternate means.
It allows 3 guesses, but I don't know how often they reset. I'm pretty sure the account was created after September 2019, but that's still a lot of possibilities.