Scoutinternal

Handling BitGo Data Erasure Requests

Handling BitGo Data Erasure Requests

Problem

Individuals submit data erasure requests to BitGo, typically invoking privacy rights (e.g., GDPR right to erasure). These requests arrive as Salesforce cases with a standardized subject line format — "Bitgo data erasure request - from [Name] - request: [ID]" (or "case: [ID]" in older submissions). Each request carries a unique alphanumeric reference code. The volume of these requests is high (219+ tickets in this cluster), and they follow a uniform, repeatable processing workflow.

Diagnostics

  • Verify the Salesforce case: Open the SF case number referenced in the ticket subject (e.g., SF#00166148) and confirm it contains a valid data erasure request with a request/case ID.
  • Check the Freshdesk link: Some resolved tickets include a corresponding Freshdesk ticket URL (e.g., https://bitgo.freshdesk.com/a/tickets/228768). Confirm the FD ticket exists and is linked to the same request.
  • Confirm request ID format: The request/case identifier is an alphanumeric string (e.g., 5MPB6R3V, LMLP55YC). Verify it is present and correctly recorded; older requests use the label "case:" while newer ones use "request:".
  • Check resolution status: Determine whether the case has already been resolved. Resolved tickets show a "This case has been resolved" note with creation and update timestamps. Unresolved tickets lack this confirmation.
  • Identify the requestor: Confirm the name on the erasure request matches the account holder or an authorized party. Do not proceed with erasure for unverified requestors.

Resolution

Scenario: erasure-data-request-from#standard-erasure-processing

Trigger: A standard data erasure request arrives via Salesforce with a valid request/case ID and the subject line follows the pattern "Bitgo data erasure request - from [Name] - request: [ID]".

Signals: data erasure, erasure request, GDPR, right to erasure, privacy request, personal data deletion, SF case, request ID

Steps:

  1. Open the Salesforce case referenced in the ticket subject and confirm the request details (requestor name, request ID).
  2. Verify that the requestor's identity matches a BitGo account holder. If identity cannot be confirmed, escalate to the Compliance team before proceeding.
  3. Process the data erasure following BitGo's internal data erasure procedures (refer to internal compliance runbooks for the current step-by-step erasure workflow).
  4. Once erasure is completed, mark the Salesforce case as resolved. If a corresponding Freshdesk ticket exists, update and close it as well.
  5. Record the resolution timestamp. Resolved cases should show both a "Created at" and "Updated at" timestamp along with the confirmation "This case has been resolved."

Notes: - These requests arrive in high volume and follow a uniform format. Batch processing may be appropriate where internal tooling supports it.

  • Older requests use the label "case:" (e.g., "case: LMLP55YC") while newer requests use "request:" (e.g., "request: 5MPB6R3V"). Both are valid identifiers and should be treated identically.
  • Some resolved tickets include a Freshdesk URL (e.g., https://bitgo.freshdesk.com/a/tickets/228768); not all tickets have a corresponding FD link.
  • If regulatory or legal holds apply to the account, do not proceed with erasure. Escalate to Compliance.

"Created at: Sun, Mar 19, 2023 at 8:58 PM PDT Updated at: Sun, Mar 19, 2023 at 8:58 PM PDT This case has been resolved FD: https://bitgo.freshdesk.com/a/tickets/228768" (ticket #41462)

"Created at: Mon, Mar 20, 2023 at 12:27 AM PDT Updated at: Mon, Mar 20, 2023 at 12:27 AM PDT This case has been resolved FD: https://bitgo.freshdesk.com/a/tickets/229089" (ticket #44869)

Related

  • none identified