- Case Number: a20140713.1
- Status: close
- Claimant: Christian B
- Respondent: CAcert
initial Case Manager: EvaStöwe
Case Manager: MartinGummi
Arbitrator: EvaStöwe
- Date of arbitration start: 2014-08-10
- Date of ruling: 2014-08-11
- Case closed: 2014-09-14
- Complaint: delete assurer account
- Relief: TBD
Before: Arbitrator name arbitrator (A), Respondent:CAcert (R), Claimant: Christian B (C), Case: a20140713.1
History Log
- 2014-07-13 (issue.c.o): case [s20140712.71]
- 2014-07-13 (iCM): added to wiki, request for CM / A
- 2014-07-13 (iCM): notified C about case
- 2014-07-26 (iCM): repeated requst for CM / A
2014-08-10 (CM): I'll take care about this case as CM and EvaStöwe will be A
- 2014-08-10 (CM): initial mailing
- 2014-08-10 (A): discussed the current delete account procedure and possible changes with two support engineers
- 2014-08-11 (A): ruling, send to C, Support, CM
- 2014-08-11 (A): example mail send to Support
- 2014-08-11 (Support): suggestion how to mark this cases in the audit-table
- 2014-08-11 (A): agrees to suggestions from support
- 2014-08-11 (Support): informs A how they will process in the current case
- 2014-08-24 (Support): informs A that the account of the C was closed
- 2014-09-14 (CM): close case
Private Part
Link to Arbitration case a20140713.1 (Private Part), Access for (CM) + (A) only
EOT Private Part
original Dispute
> Hallo, > > es könnte sein, dass ich seit Jahren immer noch als "Karteileiche" in > eurem System registriert bin. An das genauso alte Passwort erinnere ich > mich nicht mehr. Könnt ihr bitte prüfen, ob noch Daten von mir vorliegen > und die ggf. löschen? > > Ich habe beim auch noch alte Formulare gefunden, mit denen ich damals > als Notar die Identität anderer Personen bestätigt habe. Ich gehe davon > aus, dass ich diese Formulare nach 5 Jahren vernichten kann, oder?
- Short English summary by iCM:
The claimant thinks that he has an inactive account with CAcert for which he has forgotten the PW. He askes to check if CAcert has some data about him and if we could delete this data.
He also declares to have some old CAP forms and that he thinks that he probably may destroy them after 5 years.
Discovery
According to a notice attached by support to the dispute:
The user is assurer and wants his account deleted. The last certificate expired [over 3 months ago]. The last given assurance was [over 7 years ago].
There exists a precedents case a20111128.3 for delete account cases of non-assurers. The reason why assurer are not covered by the precedents case is to be able to collect the CAP forms that are hold by the assurers.
Assurer only agree to hold CAP forms for 7 years. Afterwards they are allowed to destroy the CAP forms and CAcert (or anybody else) cannot assume that they exist afterwards. In this case there is no need to collect them by the Arbitrator.
In a20111128.5 there was already a delete account case for an assurer who's last assurance was older than 7 years and the Arbitrator decided that there was no need to collect the CAP forms. Instead support was asked to handle the case analog to a20111128.3, after the Arbitrator ensured, that the CAP forms were destroyed.
To summarise: If an assurer asks for the deletion of the account and the last assurance issued by the assurer is older than 7 years, the case can be handled analog to a20111128.3 by support if the assurer gives a CARS that all CAP forms were destroyed.
Ruling
As the Arbitrator of a20140713.1 [1] I come to the following ruling:
Part 1.: precedents ruling
- Delete account cases of assurers who did not assure someone within the last 7 years at the time of the closure of the account, may be handled by support corresponding to the process defined in the ruling of a20111128.3.
- The process has to be adjusted as following:
- In the mail of the first step the assurer has to be asked to confirm the destruction of the CAP forms, if this was not already confirmed with the request to delete the account.
- If the assurer does not provide this confirmation within a reasonable time frame (e.g. 3 weeks if no special circumstances apply) the account may not be closed based on this ruling and the case has to be handed to Arbitration with a dispute.
- Before the account may be closed it has to be ensured by support that there is no new assurance given by the assurer. This may be done by blocking the account for assurances. If a new assurance is given by the assurer, the account may not be closed based on this ruling.
- After the case is closed it has to be listed as required in a20111128.3 and marked as an assurer case. (For example with an "A" in an additional column.)
- If the last assurance given by an assurer would reach the 7 years within the 3 month delay required to keep the account after the last certificates validity ended, a delete account case for this account may be treated as described above, with the adjustment that it has to be ensured by support that the CAP forms are destroyed only after the 7 years are over.
- If the duration, how long CAP forms should be kept by assurers is changed e.g. by Policy Group, the 7 years mentioned in this ruling should be adjusted, accordingly.
- The Arbitrator of this case should provide support with an updated example of the mail required in the first step of a20111128.3 and an adjustment of it for assurer cases covered by this ruling.
- Sensible adjustments my be done by support to the the example mails as needed. If it is a general change, this should be documented as post-Arbitration action in a20111128.3, and a20140713.1.
Part 2.: Ruling regarding the account of the claimant
As far as known, the account of the claimant fulfils the prerequisites for the above precedents ruling.
The Case Manager of this case should provide support with all needed information to enable support to handle the closure of the account of the claimant by the just defined process. Support than should execute it.
-- Hamburg, 2014-08-11
[1] http://wiki.cacert.org/Arbitrations/a20140713.1
Example mail
I hereby provide you with a new example for a mail for step 1 of the delete-account process, as required by my ruling of a20140713.1. ==== SNIP ===== Dear <user>, We received a deletion request for your CAcert account dated ####-##-##. If this does not represent your wish, please respond within 14 days (deadline set to: ####-##-##). Otherwise this case will be acted upon automatically and lead to the closure of your account. If you want to delete your account because you have lost the access to it, an alternative may be to try to recover your account. In this case your assurance points, assurance state, domains, and certificates would be retained. For more information see. [1] The process for the deletion of an account is laid out in the precedent arbitration case a20111128.3 [2]. [1] http://wiki.cacert.org/FAQ/LostPasswordOrAccount [2] http://wiki.cacert.org/Arbitrations/a20111128.3 -- Kind Regards <SUPPORT TEAM MEMBER> CAcert support ===== SNAP ===== The following part can be added if you think it may be relevant: ===== SNIP ===== The process for the deletion of an account is laid out in the precedent arbitration case a20111128.3 [2]. It will be handled based on the Dispute Resolution Policy [3]. If you have accepted the CAcert Community Agreement [4] you have agreed to this. If you have any issues in this regard, please notify us. The governing law is that of NSW, Australia. [...] [3] http://www.cacert.org/policy/DisputeResolutionPolicy.php [4] http://www.cacert.org/policy/CAcertCommunityAgreement.php ===== SNAP =====
Execution
- 2014-08-11 (A): ruling, send to C, Support, CM
- 2014-08-11 (A): example mail send to Support
- 2014-08-11 (Support): suggestion how to mark this cases in the audit-table
- 2014-08-11 (A): agrees to suggestions from support
- 2014-08-11 (Support): informs A how they will process in the current case
- 2014-08-24 (Support): informs A that the account of the C was closed
Similiar Cases