Today, while cleaning out my password manager, I noticed that I still had an OVH account from years ago. Trying to keep my accounts to a minimum (still far over 100), I decided to delete it. After logging in to my OVH account and checking the web interface for a few minutes I could not find a "close account" option. Googling the issue also returned only blogspam, no actual answers.
Thank god for GDPR Art. 17 - The right to be forgotten.
Quickly searching for any GDPR related sites on OVH yields GDPR – How to exercise your rights .
The caveat: If you create a ticket there, you will get a nice email stating:
In accordance with Article 12 of the General Regulation on the Protection of Personal Data (RGPD), we must ensure your identity before sending any personal information about you. These basic security measures guarantee the confidentiality and protection of your personal data.
Consequently, we would be grateful if you could send us a copy of a valid identity document, both sides, concerning you, in order to process your request correctly.
And that is the point where OVH - like many service providers - try to add additional friction to the process so people give up and keep their account.
Thankfully, the GDPR also has a solution for this.
This time I created a support ticket directly from my OVH account, so that it is connected in my account. My ticket text states:
I would like my account closed. In my last request I was told to send an ID document.
In accordance with the Guidelines 01/2022 on data subject rights - Right of access (https://edpb.europa.eu/system/files/2022-01/edpb_guidelines_012022_right-of-access_0.pdf), it should not be necessary for me to send OVH an "identity document". The referenced document (paragraph 65) specifically states:
Such additional information should not be more than the information initially needed for the verification of the data subject’s identity (authentication).
Thus, providing OVH with a valid email verification on the address belonging to the account in question should suffice under European law to confirm my identity, especially since I have not uploaded any identifying material to OVH that it could be compared against.
To be honest, I don't know if this is legally correct or if OVH was just annoyed enough to give in to my deletion request. The important thing is that it worked.
PS: This also worked with a Blizzard account.