[GDPR] - Receiving a Customer Redaction Request

Highlighted
Shopify Staff
Shopify Staff
257 1 63

Hey All, just wanted to share a quick update from the team.

 

In May, we shared communications regarding the European Union’s new General Data Protection Regulation (“GDPR”) and what it means for merchants and developers on our platform.

One key aspect of the GDPR is that individuals now have the right to request access to their personal data and/or have their personal data deleted. To execute these requests, all developers on our platform who handle personal information are required to subscribe to our mandatory webhooks.

 

How developers receive requests around personal data

When Shopify receives notice from a merchant that a customer would like their personal data deleted, Shopify will redact all the personal data it stores on that customer and push that redaction request to you to fulfill as well. Likewise, if a customer requests to view their personal data from a merchant, Shopify will also send the merchant the requested data and push the same request to you. In general, the GDPR requires that the personal data be redacted upon request, unless you have another legal reason not to do so.

 

Implementation and Timing

We will begin sending out payloads for Customer Redaction and View Data on August 25th, 2018.

These payloads are being delivered through three webhooks; the two we introduced in May (Customer Redaction and Shop Redaction), and a third (View Data) which will be available by August 25th.

With all of these webhooks, unless you are legally required to retain the data, requests should be addressed within 30 days of receipt.  For details, visit the GDPR Webhook Docs

 

Receiving a Customer Redaction Request

We’ve broken down the Customer Redaction process into a few steps:

  1. Customer contacts merchant to request erasure of their personal data.

  2. Merchant clicks “Remove personal data” of the customer in their admin.

  3. Shopify redacts the personal data it holds on the customer, and sends a payload on the customers/redact topic to installed apps with the resource IDs matching the customer that has requested redaction.

  4. Apps receive the redaction request and are required by GDPR to redact the personal data. However, there are some cases where you do not need to redact data if there is another legal reason for keeping it. Please see Processing GDPR data requests for more information.

  5. If you are redacting, you have 30 days to do so.

 

Receiving a Shop Redaction Request

Similar to the Customer Redaction request we talked about above, we’re also introducing a Shop Redaction webhook. This webhook is intended to erase personal data for an entire store. 48 hours after a shop uninstalls your app, we will attempt to send you a shop/redact webhook. This webhook will provide the shop_id and shop_domain so that you can erase their customers’ personal information from your database. Similar to the customer redaction request, you should do so within 30 days.

 

Receiving a View Data Request

Implementation details will be coming very shortly.

 

For a quick recap:

Who is affected by this change? For the sake of simplicity and fairness, Shopify is honoring GDPR requests from everyone, even though the GDPR technically only applies to individuals who reside in the European Economic Area (“EEA”). Any app that offers goods or services to residents of the EEA is subject to the law (almost everyone!).

What do I do? Implement the two mandatory webhooks.

Why? To ensure compliance with the new European General Data Protection Regulation.

When? Shopify will begin sending payloads on August 25th, 2018.

For more information, please see our blog ‘What App Developers Need to Know About GDPR’, our helpdocs on GDPR, and our docs on user privacy and apps.

 

Developer Experience @ Shopify
0 Likes
Tourist
13 0 1

Hi Ryan,

Quick clarification question.

Does this only apply to Shopify app developers?

We haven't developed any Shopify apps, but we handle all API requests for our clients' stores. Does this apply to us?

Thanks

0 Likes
Shopify Staff
Shopify Staff
257 1 63

This would apply to anyone who is receiving and storing customer data through the API.

Developer Experience @ Shopify
0 Likes
Shopify Partner
30 0 8

Are shop name and (xxx.myshopify.com) and email considered personal data?

 

Build Shopify Applications with the most simple UX possible
0 Likes
Tourist
22 0 1

I have a private app that uses the Admin API to work with my Shopify Storefront and Printful Fulfillment service.  I do not request or store any customer data on my servers at this time.  However, Printful does have customer data that is clearly collected from Shopify.

I assume that Printful is complying with this requirement.  Am I also required to do anything?

Thanks.

0 Likes
Shopify Staff
Shopify Staff
257 1 63

Are shop name and (xxx.myshopify.com) and email considered personal data?

No, this is customer data, not that of a Shopify Merchant.

I have a private app that uses the Admin API to work with my Shopify Storefront and Printful Fulfillment service. 

Yes Printful is required to comply, for private apps there is no action on these webhooks.  It's expected that if necessary merchants will relay the required info to be redacted to private app developers as private apps are considered an extension of the shop.

 

Developer Experience @ Shopify
0 Likes
Tourist
13 0 1

Ryan,

I could use some more clarification based on your last response on the thread.

My company handles data feeds for our clients. We haven't developed any Shopify apps, public or private. We only make use of the Admin API.

Will actions on these webhooks be required from us? Or, is this the Store's responsbility to handle and then relay those requests to us?

Let me know if I can clarify anything.

Thanks

0 Likes
Shopify Staff
Shopify Staff
257 1 63

Only public apps will have the ability to register for mandatory redact webhooks.  Any other usage of the data including private apps and integrations (which is sounds like you are) is the responsibility of merchant.

Developer Experience @ Shopify
0 Likes
Tourist
13 0 1

Thanks, Ryan!

0 Likes
Trailblazer
636 0 87

Hi Ryan,

I have summarized a few questions below:

1) What will happen if we try to load an order for which the customer requested deletion.
Will order.customer be null? Or will it be non null with a customer id and all other personal fields null?

2) What is the purpose of the 48 hours delay?
 
3) When the customer order information is redacted, will the order/update webhook be triggered with missing customer details (e.g., a null customer_id, no billing/shipping address, email, or phone)?

This would be ideal because it would avoid every app implementing their own data cleaning methods and simply rely on Shopify to remove all personal details

0 Likes