Recently I have tried to delete as many of my online accounts as possible to reduce my personal data footprint. A few weeks ago, I wanted to delete an AWS account. Here’s how it went.
Before you start reading, I recommend you start playing this article’s soundtrack. Just a recommendation.
First, I tried going to the settings for my account, but they wanted me to add credit card information first, which I obviously didn’t want to do. So I opened a support ticket, and here’s what I wrote:
me: Hello, how do I delete my account without giving my credit card information? The web interface wants me to give it when I go into “my account”. My email address is ****.
I seriously do not appreciate having to go in here and talk to someone for something as trivial as deleting my account. As a european citizen, I also want my entire data deleted (GDPR).
Here’s how they replied:
them: The thing is the following I just review the account information, the account is in created status
so you need to finish the activation process to be able to close it, if you do not finish the process of activation by adding a valid card, the account will remain in that status, but it does not generate any charge to you in case you can not add a card.
First, as said above, I didn’t want to give any credit card information. This is not something they need to delete an account, and there is absolutely no possible debate here.
I was already pretty angry, and here’s what I replied:
me: I don’t care. I just want my account deleted and that is my right. The name I registered as is tarneo.
them: Yes, that is what I am confirming, an account can not be deleted and closed until you finish the activation process.
That would be the way it works.
Here, what they are really saying is this: “we don’t want to delete your account until you give us your credit card, because doing that will already make it easier for us to start offering ‘services’ to you, and so you will probably not want to delete your account anymore.” Or it’s: “You never gave us enough information, why would we delete it?”
me: It can, it is in the law. Did nobody at amazon read GDPR?
Because in that it is clearly stated that any european citizen can delete information at a company if he wants to, and amazon does not have the right to change that or force people into giving them more personal information.
them: Please note, all the details in your use case has been considered carefully and in line with our Service Agreement: https://aws.amazon.com/agreement/
We’d also like to remind you that as part of our agreement, you are responsible for all activities that occur under your account, including all applicable fees and charges for use of our services. We also ask that you please review our Shared Responsibility Model here: https://aws.amazon.com/compliance/shared-responsibility-model/
They are just trying to trick me into thinking it’s a complicated legal mess. What I know is not a complicated legal mess is article 17 of GDPR, the ‘right to be forgotten’.
I never opened any of those links they sent me :-)
Article 17 is what I quote just after:
me: You have the right to have your data erased, without undue delay, by the data controller, if one of the following grounds applies: Where your personal data are no longer necessary in relation to the purpose for which it was collected or processed.
I’m sorry but it is my right. My personal information is not at all necessary because I have not used any of amazon’s services.
Then they try to trick me again:
them: By now you can delete the information as I said, but you need to finish the activation process, if you don’t the account will remain as that, but as I mentioned this does not cause any issue, but if you rally need to terminate it, you have to go and finish the acivation process. I would like to say there is other way, but AWS can not close an account that has not been activate yet.
Are you getting tired of it like I was?
them: By now I already informed you about the process needed to accomplish your request, so you would need to follow the steps as needed. By now is there any other question that I can help you with?
Dear Amazon employee, if you could have seen the size of the smile I had on my face by then…
What I knew is they just couldn’t close the support ticket, and were just trying to get me to leave. But I knew my rights and said this:
me: There is no reason why I would have to give my credit card info because I have nothing due.
If you can’t do anything please forward this to someone else who can actually delete the account.
I knew they wouldn’t forward this to anybody. What I think is they are just paid to get people to keep their accounts.
me: […] I don’t have to comply to what a company wants to do with my data, but it is the company that has to comply to the law if I want my data deleted.
them: You don’t have to, but the account is not active, for accomplishing your request, an account needs to be active, we can not close something is not active, so we already provided you the steps to follow. We have not provide you any charge and you where the one responsible of the activity on the account, so at this point we are going over the same question. For quality I will proceed to disconnect this chat if no further questions comes up besides what we already explained.
me: I am sorry, but the GDPR clearly states that I have the right to delete my account, even if it is not “active”. What I see is there is an account that I can log into, and some of my personal information is stored in your data centers (even though it’s not a lot). If you have some of my personal information I have the right to delete it without giving you more.
Here are the contents of the first part of art. 17 of GDPR:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; [other points]
That is why I am wanting to delete my account, and if I cannot amazon is doing something illegal (which they already do quite a lot :d)
What I am saying is that my data is no longer necessary. This is why I have the right to delete it without undue delay
them: We can’t delete something that has not been fully activated, I would like to state that we have other option, there is not other option as this account is not active. We do not have any further action besides what we have indicated you.
NOW: knowing they deleted the account in the end, this is something I could take amazon to court for. Anyway.
them: If you do not want to finish, it is OK, the account would be in pending activation status and you do not have to add anything. But you can not delete it as it has not completed the activation process, we appreciate your understanding on this.
me: Can you explain to me why I would have to enter a means to give money somewhere I don’t need to give money?
“it’s OK”: it may be OK to one of the big tech companies but it is not OK to me. Again, I have the right to delete my account and that’s it, you have nothing you can say about that. Now please do something or we will be chatting here for the rest of the evening
them: Because a requirement to use the AWS services is to have a valid card, we understand you don’t need it, but is part of the process as you previously requested to get it.
Sigh. This is where I abandoned respect:
me: OK, what do I have to say for you to listen?
them: I understand your needs, but I am not able modify the process.
me: It must be the tenth time in a row you bring up the same argument, if you can’t do anything about my problem please forward it to someone who can. And if there is nobody who can do anything then this support is just broken.
And this is when it clicked:
To close your AWS account
Open the Billing and Cost Management console at https://console.aws.amazon.com/billing/home#/
On the navigation bar in the upper-right corner, choose your account name (or alias), and choose Account.
Scroll to the end of the page to the Close Account section. Read and ensure that you understand the text next to the check box. After you close an AWS account, you can no longer use it to access AWS services.
If the account has a multi-factor authentication (MFA) device turned on, keep your MFA device until the 90 day post-closure period expires, or turn off before closing the account.
Select the check box to accept the terms, and choose Close Account.
In the confirmation box, choose Close Account.
them: I just requested assistance from the service team, please proceed to close the account now.
This conversation lasted for roughly 45 minutes.
The entirity of the transcript is available here.