How do I delete my forum account?

[darryl]

This is Article 4(1):

For the purposes of this Regulation:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

This is Recital 30:

1Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. 2This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

The letter in my post #14 said in part:

As you have mentioned in your email, you are processing personal data during the course of your activities. This can include email addresses as they could identify a living individual in certain formats. Additionally, the GDPR is now identifying IP addresses as personal data. The legislation covers this in Article 4 (1) which includes online identifiers and is extended upon in Recital 30.

The definition is very wide and they seem to be interpreting it more widely still. I think it is a real stretch, for instance, to include ip addresses. Just ask the copyright trolls thrown out of court in the US for failure to link a name to an ip address. The authorities clearly believe that email addresses are also included. They seem to think any identifiers which alone or with other gathered information can be used to identify a natural person are caught. Clearly members who register with their own email and their actual name are providing personal information. I'm not sure what other data is collected/stored but it is likely that we are storing personal information on probably most of our members.

[Sarmat89]

Originally Posted by darryl

I think it is a real stretch, for instance, to include ip addresses.

Is there a reason you want to harvest people's IPs and e-mail addresses against their will?

[darryl]

Originally Posted by Sarmat89

Is there a reason you want to harvest people's IPs and e-mail addresses against their will?

You really should be more careful with making assumptions.

I have no official position at Mobileread. I am a member only. I use the words "we" and "us" simply because I feel I have a stake in the forum operating and wish to help out if I can. I'm not sure exactly what information Mobileread collects. However, you may recall that when you signed up you were asked to provide an email address and some other details, which I presume you did willingly. As far as I'm aware limited information is simply collected and stored for purposes of the operation of the forums. I have certainly never received marketing emails or other spam as a result of my Mobileread membership, so my information does not appear to have been sold.

Most sites you visit will log the ip address you are apparently visiting the site from, for valid reasons. IP addresses do not usually identify a person. They may identify the owner of a particular account with an ISP, but only if you are able to legally compel the ISP to hand over the information. They do not establish which particular person accessed the site.

Like many Government initiatives the EU has sought to address a very real problem with a ridiculously over-reaching piece of legislation, complete with vague drafting to encourage uncertainties and give it the widest possible reach. They are obviously taking the view that even the smallest online forum which requires registration is caught, and must bear the compliance costs. If they could actually enforce this outside the EU I suspect many forums would close.

[DaleDe]

When I looked at the description of the legislation it talked a lot about collecting information that the user doesn't authorize. We do not do any of that. All information about a user is directly submitted by the user. Most is optional. The only statistic that we generate is the number of posts and that is clearly displayed. I think a typical forum doesn't collect things the user would be worried about.

[sjfan]

Originally Posted by DaleDe

When I looked at the description of the legislation it talked a lot about collecting information that the user doesn't authorize. We do not do any of that. All information about a user is directly submitted by the user. Most is optional. The only statistic that we generate is the number of posts and that is clearly displayed. I think a typical forum doesn't collect things the user would be worried about.

The typical GDPR problem for non-commercial and non-malicious sites isn't that they're harvesting stuff against the user's will. It's that even if the user consented/was informed up front, they're allowed to come back after the fact and say “I no longer want you to have X, Y, and Z pieces of personal information” (including IP address as a possibility).

And at that point you must scrub that info from all databases, server logs, backups, etc in a timely fashion.

Lots of out of the box setups aren't designed to (for instance) go through all the Apache logs and eliminate IP addresses, or go through and delete first/last names from not just the main user records but debug logs, change history, quotations in messages, etc. Some systems are smart enough that some of that is stored as pointers into the main record (especially quotes), but some aren't and some of that (change history) is inherently stored as copies for good reason.

So compliance becomes a bit of a PITA to dot all the i's and cross the t's.

[DaleDe]

Wow, going back after the fact and undoing stuff that was there for eons is totally unreasonable IMHO. There are archive sites that collect pages and those won't go away even if the main site does. What is it that they say? You can't change history.

Dale

[Apparition B5]

This European law may have a chilling effect on the Internet as a whole. Most smaller and non-commercial websites simply do not have the manpower or capacity to comply with it, at least not completely. Sites owned and operated outside of Europe may simply decide to block European users as a whole, leaving Europe only with access to sites owned by companies large enough to supply the manpower and capacity to comply with GDPR.

"The road to Hell is paved with good intentions."

[June]

A site (or business) can store personal information based on the individual’s consent. This consent is given when the person enters the info.
The problem is if the person changes their mind - then the lawful basis of data processing is gone. Anonymizing (is that a word?) the data could be the best way to solve this after someone requests account deletion.

So best would be if one could argue ANOTHER basis for the processing, not consent. From memory some grounds for data processing are: it is necessary for performing the request/contract, certain interests etc. others are related to public interest, legal requirements etc.

The other possibility MIGHT be that the consent could be written in a way to enable deactivating accounts while info remains (posts, stats) etc. this could also be sensible since there is the conflicting side of the coin of keeping records and not destroying possible evidence etc. I would aim to have a consent that basically states that anything done while an active member remains on public side and IP etc is inaccessible to admins (is it?) after deactivating the account. The right to be forgotten/anonymize could maybe be done by admins by changing the user name to a random string when deactivating the account.

Anonymized data can be stored and processed. So it is a question of wether the user info is obscured enough “behind the scenes” for full compliance with the regulation this way.

Since we don’t have any case law yet, it will not be possible to say with certainty how these purposes will be interpreted. But the aim of the legislation is to ensure privacy and secure data processing, not to hinder normal accepted activities... that said, it is a mess until we get case law or country specific legislation in EU.

Disclaimer: I’m a lawyer and have attended a few courses on this, but don’t have my material with me when writing. This is not legal advice, etc

[BetterRed]

@June - Good to hear from European member who knows what they're talking about.

I've read the following elsewhere: given GDPR is an EU Regulation, as opposed to to Directive, country specific legislation as such isn't necessary. Curious as to whether you have any thoughts on that?

BR

[darryl]

Agreed. Being a lawyer in one country certainly helps, but it is still far better to hear from a local lawyer bearing in mind always that lawyers expressing their views on forums like this one does not constitute legal advice which can be relied upon, and is all care but no responsibility.

[June]

Originally Posted by BetterRed

@June - Good to hear from European member who knows what they're talking about.

I've read the following elsewhere: given GDPR is an EU Regulation, as opposed to to Directive, country specific legislation as such isn't necessary. Curious as to whether you have any thoughts on that?

BR

Yes, this is EU regulation that is directly valid and enforced in the member countries, no country specific legislation necessary (unlike the preceding directive). And normally the EU discourages country specific “additions” to these. But in this case there has been some signals that countries might be “allowed” or even maybe encouraged to add legislation, because the regulation is so broad and maybe in need of specifics.

That said, the EU regulation is the one that is valid and has to be applied in all member countries.

https://www.eugdpr.org

[DiapDealer]

I hereby grant Mobileread the right to ignore any of Future Me's potential demands to delete, obscure, or anonymize any of Past (or Current) Me's consensually given data.

[GeoffC]

Originally Posted by DiapDealer

I hereby grant Mobileread the right to ignore any of Future Me's potential demands to delete, obscure, or anonymize any of Past (or Current) Me's consensually given data.

Chuckles.....

By my reading of the issue, even on vbulletin.org, is that every member would be required to say same, or similar.

Storing IP addresses is an interesting one, especially when quite a few folk use virtual IPs that won't link back to them personally, so too for email addresses. Mind, knowledge of IP addresses on a Forum like vbulletin help identify and nullify spambots.

PITA and molehills spring to mind, I don't envy Alex in trying to sort this issue out on a site as large as MR. I'm, like I guess many others, in similar boats even with smaller Forums.....