8

GDPR defines "personal data" as any information relating to an identified or identifiable natural person.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

By that definition, it sounds like anything a user writes on a website that requires registration (even if with only an email and a password) is to be considered personal data, even if that data is meant to be public like in the case of internet forum posts, even if the post content is just a simple opinion, thought, or story. Is this correct? Or are there any specific cases where forum posts might not be treated as personal data?

0

2 Answers 2

5

In the general case, it seems unlikely, based on the wording (which is convoluted). In certain cases, if the president of Russia posts "My name is Vladimir Putin", that post is personal data. On the other hand, you might, based on my writing, conclude that I am from the US, and you might even conclude that I'm in Washington state, but that doesn't distinguish me from 7.5 million others, so on those grounds that is not personal data. Eventually, though, you might identify me specifically from other things that I may have said on SE.

The definition depends on two parts. First, personal data is "information relating to an identified or identifiable natural person". Any "information" provided by a natural person is "related to" that person (as is any "information" that is about such a person). The second part defines "identifiable natural person", that is, who is an "identifiable person"? Every person can, in principle, be identified by reference to some label or description of fact about them, so every person is an identifiable person, under this definition. This means that every piece of text that refers to an individual (not even text which can identify the person) is "personal data". Obviously, any individual can be uniquely identified by some collection of identifiers; the problem is that the wording of the law does not explicitly say "using that supposed personal data". If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is.

Another term that the regulation defines and uses in a few places is "pseudonymization", which is defined as

the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person

The point of interest here is that this says that "personal data" which cannot be attributed to an individual is, nevertheless, still personal data. I think the most important part of the regulation is art. 6, which defines lawfulness of processing, especially para 4., which allows consideration to be given to safeguards such as pseudonymization.

4
  • 1
    If this is the case then the law is poorly worded. They could have said that personal data is any information that can be used to identify a person, directly or indirectly. By saying "any info relating to" it sounds like it's actually any info provided by the user, even if just a joke posted on a forum, giving the user full control over whatever they write online (like withdraw consent and delete the data). In any case, I'm afraid that posts about certain subjects (politics, health, etc.) are likely to be seen as sensitive data.
    – reed
    May 7, 2018 at 20:08
  • 3
    Apparently it has already been decided that an IP address is personal data, I suppose because it is "information relating to ... an identifiable natural person." I do not know the details, however. But if we accept that proposition then it is hard to see how data posted from an IP address would not also be personal data unless the IP address were removed. Also, the question assumes that the data has been posted through an registered user profile.
    – phoog
    May 7, 2018 at 21:47
  • 4
    Furthermore I don't think it is an oversight that the regulation does not explicitly say "using that data" because part of its purpose is to protect people from invasions of their privacy; there can be private information that does not help identify someone.
    – phoog
    May 7, 2018 at 21:50
  • "If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is." - If you can't figure out who the person is from the data, it isn't personal data within the definition in the GDPR.
    – Lag
    Jun 5, 2018 at 14:20
0

It is possible that some forum posts might not be considered personal data for GDPR purposes, but the problem will always be the amount of time needed to make that determination for every single post.

The definition given in your question is from Article 4 (1). You will note that it includes economic, cultural or social identity. Almost anything posted by a forum user could count as that. For example, mere membership of a forum for fans of football would reveal part of their cultural and social identity.

One way some people have attempted to get around this is by deleting the person's name from the site, so that posts appear to be by "anonymous user" or similar. However, if any other user has used their name, it undoes that. If their posts contain their name, or any other identifying data, it undoes that. It may also be possible to identify them by combining the "anonymous" data that remains.

It may be possible to clear all that out with a lot of manual effort. Doing so is likely to be error prone, as it will need to consider other user's posts as well. As such, deleting all posts that the user has made is usually the best option, and the most likely to be compliant. It may also be prudent to remove other instances of their posts and user name, such as quotes or mentions. Hopefully your forum software has a feature to do this for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.