Also not a lawyer, but... Was there suspicion that Ashley Madison had been wilfully negligent in the first place? It has sounded to me like the leaked data indicated they actually followed reasonable security practices. Strong password hashing, separation of different types of data, etc. Yes, they got hacked, but it's virtually impossible to guarantee immunity from target attacks.
edit: also, as others have implied, 2 suicides out of 40 million is not that high (I don't mean to downplay the tragedy - all suicides are horrible) - but IMO you'd have a hard time proving the Ashley Madison hack was really the only cause, and not the final straw for somebody who was already in a bad place mentally. If I were to tell someone that their spouse was cheating, and their spouse commits suicide, would I be criminally negligent?
Practically every system I've built at scale uses soft-deletes. A flag is put into the database and records that are deleted are excluded via that flag.
Note that I'm not playing with people's identities, but even then, you have to ask whether they were paying to delete the availability of their user data or the actual database records (somewhere in the contract?).
I think they should be clear about whether the information is still stored, true. But I also do sympathize with AM in this situation. I'm sure many of us have had the experience of going out of our way to secure someone's system for them, and then being asked years later if we can help them when they've locked themselves out. I'd be willing to bet there were more than a few people who paid to have their accounts deleted and came back at a future date and wanted to pick up where they left off.
Their overall security procedures may have been good, but at the very least the fact that they charged money for permanent deletion of data and then didn't actually permanently delete data ought to qualify. People who just signed up may not have a case, but anyone who "deleted" their account does.
Comments
Also not a lawyer, but... Was there suspicion that Ashley Madison had been wilfully negligent in the first place? It has sounded to me like the leaked data indicated they actually followed reasonable security practices. Strong password hashing, separation of different types of data, etc. Yes, they got hacked, but it's virtually impossible to guarantee immunity from target attacks.
edit: also, as others have implied, 2 suicides out of 40 million is not that high (I don't mean to downplay the tragedy - all suicides are horrible) - but IMO you'd have a hard time proving the Ashley Madison hack was really the only cause, and not the final straw for somebody who was already in a bad place mentally. If I were to tell someone that their spouse was cheating, and their spouse commits suicide, would I be criminally negligent?
Practically every system I've built at scale uses soft-deletes. A flag is put into the database and records that are deleted are excluded via that flag.
Note that I'm not playing with people's identities, but even then, you have to ask whether they were paying to delete the availability of their user data or the actual database records (somewhere in the contract?).
I think they should be clear about whether the information is still stored, true. But I also do sympathize with AM in this situation. I'm sure many of us have had the experience of going out of our way to secure someone's system for them, and then being asked years later if we can help them when they've locked themselves out. I'd be willing to bet there were more than a few people who paid to have their accounts deleted and came back at a future date and wanted to pick up where they left off.
I've dealt with PII, and soft-deletes are explicitly disallowed. But I work in an industry where "delete" is something to be very carefully defined.
Their overall security procedures may have been good, but at the very least the fact that they charged money for permanent deletion of data and then didn't actually permanently delete data ought to qualify. People who just signed up may not have a case, but anyone who "deleted" their account does.