Is it legal to refuse to delete personal data?

Question

Law in IT

Good afternoon everyone!
I was forced to use one of the Internet services, for which you need to provide personal data. The need to use the service disappeared and I decided to delete the account. In accordance with paragraph 4 of Article 21 of Federal Law No. 152, I submitted a request to stop processing my personal data and destroy them. To which the representatives of the service refused me, referring to some internal security rules, offering only to block access to my account. But of course, this option does not suit me. Could you tell me if this behavior of the service is legal and if not, how can I get them to stop processing my PD? Can I, in this case, file a complaint with Roskomnadzor and, possibly, with the Prosecutor's Office, in connection with the failure to comply with the requirements of the Federal Law?
Thanks in advance!

Answer 1

You can always withdraw your consent to the processing of personal data. This is your right enshrined in 152-FZ.
In this case, even after the withdrawal of consent, the operator has the right to continue processing your PD. But only in specific cases defined by law. No internal security rules should worry you. In your case, they may refer to the basis of processing referred to in paragraph 2) paragraph 1 of Article 6:
Here, in particular, they may refer that they will continue to process your PD in accordance with the Tax Code, the terms of storage of accounting documentation, the Federal Law "On countering the legalization (laundering) of proceeds from crime and the financing of terrorism", etc.
But at the same time, they are obliged to delete your account, so you break the contract with them and withdraw consent. And they must do this in accordance with clause 5 of article 21
Thus, the wording of the refusal to delete the PD indicated in the answer to you has no legal grounds. You can write them a new removal request, but I think in the end they will prepare the correct answer for you, or maybe this answer can easily attach it to the complaint to the RKN , which may teach them.
In the appeal to the RKN, please also note to the regulator that this Walletone also violates the requirements of
clause 2 of Art. 18.1 152-FZ:

The operator is obliged to publish or otherwise provide unrestricted access to the document defining its policy regarding the processing of personal data, to information about the implemented requirements for the protection of personal data. An operator that collects personal data using information and telecommunications networks is obliged to publish in the relevant information and telecommunications network a document that defines its policy regarding the processing of personal data and information on the requirements for the protection of personal data being implemented, as well as to provide access to this document using the means of the corresponding information and telecommunication network.

Answer 2

It depends on what kind of service, if it is not under the jurisdiction of the Russian Federation, then they wanted to give a shit about all local supervision and laws. Of course, you can try to screw up the organs, but with a high degree of probability you will be sent on an erotic journey on foot, although if you have a lot of free time and extra nerves, go ahead.

Answer 3

While you can not, the law is only being discussed appropriate.