How do I delete my forum account?

[Cyba.Cowboy]

How do I delete my forum account?

So I'm doing a bit of a "digital cleanup" and deleting/closing disused or otherwise dormant online accounts... But I cannot seem to find out how to close/delete this account.

How do I delete/close my forum account here?

[HarryT]

You don't. Just stop using it. The account will not do anything in your absence.

[Cyba.Cowboy]

Originally Posted by HarryT

You don't. Just stop using it. The account will not do anything in your absence.

I would prefer to delete an online account that I don't really use now and am unlikely to use in the future, rather than leaving it lying around "just in case"...

Virtually all forum software has the ability to delete users; some forums make such settings available users, others don't (i.e. they need an administrator to delete the account).

[HarryT]

We cannot delete your account, but we can make it inactive. Do you wish this to be done?

[Cyba.Cowboy]

Originally Posted by HarryT

We cannot delete your account, but we can make it inactive. Do you wish this to be done?

Yes please.

Thank you.

[HarryT]

Done.

[sjfan]

Originally Posted by HarryT

We cannot delete your account, but we can make it inactive. Do you wish this to be done?

Have you thought about whether GDPR/right-to-erasure legislation might affect MR? We've had discussions about it on another forum that I help administer. .

(I don't have any specific advice other than to give a heads up that it comes into effect on May 24 this year.)

[DaleDe]

Originally Posted by sjfan

Have you thought about whether GDPR/right-to-erasure legislation might affect MR? We've had discussions about it on another forum that I help administer. .

(I don't have any specific advice other than to give a heads up that it comes into effect on May 24 this year.)

Inactivating the account will remove access to all personal data. It will not remove the postings in the various threads.

Dale

[sjfan]

Originally Posted by DaleDe

Inactivating the account will remove access to all personal data. It will not remove the postings in the various threads.

Dale

My understanding of GDPR is that you need to remove all internal storage of personal data, not just external access to it. Which means that clearing the database user record, as well as backups, server logs, debugging dumps, and all other sources of first/last name, email address, IP address, and any other personally identifying information is necessary.

Simply deactivating the record is not enough, that information must be totally inaccessible to the web site admins/techies (completely scrubbed and deleted), not just removed from public display. It's a more than a bit of a PITA and runs counter to most policies on maintaining backups and data integrity, which is why it's become a huge problem even for companies that don't make a living exploiting personal data. But it also make sense in the era of Facebook and the like.

But I'm not a lawyer, you should consult one for legal advice. I'm not really interested in following up too much and don't care about it much personally, I just wanted to make sure the issue was flagged to the admins so they weren't blindsided by it.

[darryl]

This regulation is a potential nightmare. Whilst it is well intentioned and its objectives very desirable in many ways, its drafting leaves many ambiguities, I suspect deliberately so. The extra-territorial operation is a potential nightmare under certain circumstances. Since "processing" is defined to include both collection and storage without any other significant use being made of the data, it seems likely that any forums, for instance, accepting users from the EU and requiring their registration are literally caught, no matter their size, whether they charge or whether they have anything else to do with the EU over and beyond simply accepting its residents as members. This scope is of course absolutely ridiculous. In practice, there is little that the EU can do to enforce this regulation against a controller or processor without any presence or any assets within the union. Nor would it be likely to try. Many years ago I used to use a hypothetical in lectures and tutorials, asking students whether the Australian Parliament could unilaterally pass a valid law imposing a tax on all US residents. Such a law would very likely be within the power of the Australian Parliament. However, it would be impossible to enforce except against those few US residents who were unfortunate enough to have a presence or to visit, or who held assets here. Secondly, of course, is the principle of reciprocity. The US could and would quite justifiably retaliate. Many countries, of course, including the US and of course the EU member countries, do increasingly test the boundaries of extra-territoriality. How far can they go without triggering more than a luke warm protest by other countries whose citizens are affected?

In the case of Mobileread it appears likely that because we accept EU residents and gather and store personal information we are caught by this regulation. However, it would seem that in a practical sense the EU could not enforce compliance in the absence of a controller, a processor or assets within their jurisdiction.

The text of the Regulation can be found here for anyone interested. I should add that I count myself fortunate not to live in the EU and that I do not profess any expertise in their law. This is not legal advice and cannot be relied upon. I've set out my very cursory view based only on the text of the Regulation here for purposes of discussion only.

[BetterRed]

@darryl - the Mobileread site is hosted at Hetzner Online GmbH in Germany, which would be within the reach of EU courts.

BR

[darryl]

Originally Posted by BetterRed

@darryl - the Mobileread site is hosted at Hetzner Online GmbH in Germany, which would be within the reach of EU courts.

BR

Thanks. I suppose if worst came to worst we could seek a host outside the EU. The problem is of course the uncertainty. Sites like Mobileread do not have the budget to get the legal advice which is likely required. To comply also requires money to develop the various policies and forms. I suppose it would be possible to approach the EU authorities for their guidance, but this also could be a two-edged sword. If they were to say we had to comply, could we afford to? Maybe there are cheap or free policies and forms floating around somewhere. And if we didn't and they decided they wanted a test case who had deliberately not complied? We'd probably simply not participate and they would impose a fine or some other punishment they could not enforce.

I suspect the rules are not aimed at forums such as Mobileread and I doubt that the EU authorities intend to try to enforce them in these cases. It may be that the only practical alternative is to take the view that these rules are not intended to apply to us. Since we don't actually make much use of the information many of the rules are of little concern anyway. Perhaps it would be prudent to seek to comply to the extent that it can easily be done and take steps to avoid complaints. For instance, perhaps we can find a way to accommodate those requesting to delete accounts like the request in this thread. Even if we are not fully complying the lack of any complaint makes any action even more unlikely. I see little prospect of the EU being able to force co-operation in any audit or force the provision of information about compliance or otherwise.

I'm not sure about the legal structure of Mobileread, but would imagine the problem is probably Alex's. The worst think that could probably happen in that case is we need a new host and Alex needs to be careful about visiting the EU or having assets there. (I presume he doesn't live there)?

[BetterRed]

I have a feeling Alex lives in Switzerland, which is almost in the EU.

According to this Switzerland has signed up to the European Arrest Warrant directives and I suspect it has or will sign up to the GDPR directives.

Maybe Alex would like to follow Kim Dot Com and move to NZ so he can chase Hobbits rather than Gnomes

BR

[darryl]

It's almost certainly a storm in a teacup. I cannot imagine that the EU seriously wants to try to enforce this in relation to free online forums without any true connection to the EU. Unfortunately the way the law seems to be written. Perhaps we have some members who are EU lawyers or have some expertise in this area who are a little better informed than I am after my very brief look.

By the way, this came up on a brief search. It is from HERE

The ICO have finally replied
Dear Mr #########

Thank you for your correspondence (attached for your reference).

I am sorry for the delay in responding. We are experiencing a very heavy caseload at the moment.

I understand from your email that you are the Administrator for a number of online forums and you wish to know how the General Data Protection Regulation (GDPR) will affect you.

As you have mentioned in your email, you are processing personal data during the course of your activities. This can include email addresses as they could identify a living individual in certain formats. Additionally, the GDPR is now identifying IP addresses as personal data. The legislation covers this in Article 4 (1) which includes online identifiers and is extended upon in Recital 30.

The result of this is that you need to comply with the provisions of the GDPR when processing personal data. Our Guide to the GDPR outlines the provisions of this legislation. A good introductory resource you may wish to review is our ‘GDPR: 12 steps to take now’ document and our ‘Getting ready for the GDPR checklist’.

It is also possible that you may need to register with us. The criteria on this on are still being consulted upon so unfortunately I cannot provide a definitive line on that at this time. Our blog ‘ICO fee and registration changes next year’ currently provides our most up to date information on this.

I hope this information is helpful to you. If you would like to discuss this case further, please contact me on my direct number 0330 ####### If you need advice on a new issue you can contact us via our Helpline on 0303 123 1113 or through our live chat service. In addition, more information about the Information Commissioner’s Office and the legislation we oversee is available on our website at www.ico.org.uk.


Yours sincerely

Martyn Boaler
Lead Case Officer
Information Commissioner’s Office

What a nightmare piece of legislation. Done under the guise of protecting privacy.

[DoctorOhh]

The question I have is does the data Mobileread has on people fall under the definition of personal data for this law. Here is the definition of personal data from the site created to explain the law.

What information does the GDPR apply to?

Personal data

The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.

The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.

Personal data that has been pseudonymised – eg key-coded – can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.