Quote:
Originally Posted by DaleDe
Inactivating the account will remove access to all personal data. It will not remove the postings in the various threads.
Dale
|
My understanding of GDPR is that you need to remove all internal storage of personal data, not just external access to it. Which means that clearing the database user record, as well as backups, server logs, debugging dumps, and all other sources of first/last name, email address, IP address, and any other personally identifying information is necessary.
Simply deactivating the record is not enough, that information must be totally inaccessible to the web site admins/techies (completely scrubbed and deleted), not just removed from public display. It's a more than a bit of a PITA and runs counter to most policies on maintaining backups and data integrity, which is why it's become a huge problem even for companies that don't make a living exploiting personal data. But it also make sense in the era of Facebook and the like.
But I'm not a lawyer, you should consult one for legal advice. I'm not really interested in following up too much and don't care about it much personally, I just wanted to make sure the issue was flagged to the admins so they weren't blindsided by it.