Data Deletion for Age Verification
Fox P McCloud
So, if I submit my data to Persona, and the verification process is completed, I can then request that they delete all my data (on their side), and it won’t impact my 18+ verification, correct?
Well, if this truly is the case, could VRC ensure that this just happens automatically with Persona, via your guys’ negotiated contract? That is to say, data is kept for the verification process, then deleted immediately after verification, thereby ensuring that once the initial verification step has been completed, no data, other than the birth date, is retained anywhere, by anyone.
Log In
Tsukare
"We can also set an automated retention period for you, after which we permanently delete all PII."
I don't know why VRChat wouldn't just set a retention period of 1 day.
Zazz
It's not clear, but I think the FAQ already says that.
Quote: "You may also request that Persona delete your ID data at any time. This will not affect your Age Verification status."
Interpretation: Persona doesn't need to keep "ID data" for you to retain your status.
Quote: "Some data must be stored with Persona while you maintain a Verified Account that lets us know if an ID has already been used."
Interpretation: Persona does need to keep "some (other) data" for you to retain your status.
Quote: "Persona will retain your ID data for as long as necessary to provide Age Verification for VRChat."
Interpretation: Less clear but, with this wording, the specification of "ID data", and the first quote, I believe they're referring to just the length of the process it takes to confirm your date of birth, rather than the length of your verified status.
If not, I believe it's something they actually need to do to comply with GDPR. I think data is only allowed to be kept as long as needed for its stated purpose. Once verification is done, anything that doesn't need to be kept to maintain that status (ID data), should be deleted.
ᴋᴀᴡᴀ
I still don't get why Persona need to store all of our private info for indefinite time, if it's no more necessary for keeping verified status.
PeachiPrism
Exactly my though, the whole announcement makes it seem like that is a possibility but they phrase it in such a way where they are avoiding saying that it's something that it's possible. Guessing it's to do with their contract making them not allowed to point and go "hey guys you can delete ur persona account after btw" maybe?? I just feel like it should be autodeleted after the verification.
Orionware
I also would prefer that this is not something a user must do manually. This information does not need to be retained and puts users unaware they can delete this information at unnecessary risk.
Chriin
Seconding this. I personally don't have a issue with age verification or the companies in use. I do have issue with where the company is located and them retaining that data. The process to have this data deleted on Persona's end needs to be easy and straight forward. I shouldn't need to jump through hoops to have this deleted from their end nor should I need to hunt for how to get said data deleted from them.