GDPR and deleting users from wiki changelogs

Question

According to the GDPR §17, users have a right to request the deletion of personal data. I am wondering how this applies to wikis.

In my case, when users edit a page, that edit is associated with their username by writing it to a changelog of that page.

Users can delete their account which will remove their profile data but it will not remove the name from the changelog.

Is the their username alone, without any attached profile (like their email address or real Name) still considered personal data that has to be deleted?

Answer 1

Is the their username alone, without any attached profile (like their email address or real Name) still considered personal data that has to be deleted?

For something to be ‘personal data’ it must information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. In other words: If the natural person can be indirectly identified from the username, it is personal data. If he cannot, it is not personal data.

This obviously depends on the circumstances. If the user used something very similar to his real name, or his email address or uses the same nickname on a lot of different systems, then it probably is personal data. If it is an unique pseudonym that is not used elsewhere, it is less likely.

If you want to make sure you comply with the right to erasure, you may want to scrub your wiki database, replacing all the username of the deleted user with "anonymous" (or something like that). If you want to be able to treat these as separate users, your scrubbing process may use unique anonymous identifiers ("anon-1", "anon-2", and so on).