Are internet forum posts considered personal data under GDPR?

Question

GDPR defines "personal data" as any information relating to an identified or identifiable natural person.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

By that definition, it sounds like anything a user writes on a website that requires registration (even if with only an email and a password) is to be considered personal data, even if that data is meant to be public like in the case of internet forum posts, even if the post content is just a simple opinion, thought, or story. Is this correct? Or are there any specific cases where forum posts might not be treated as personal data?

Answer 1

In the general case, it seems unlikely, based on the wording (which is convoluted). In certain cases, if the president of Russia posts "My name is Vladimir Putin", that post is personal data. On the other hand, you might, based on my writing, conclude that I am from the US, and you might even conclude that I'm in Washington state, but that doesn't distinguish me from 7.5 million others, so on those grounds that is not personal data. Eventually, though, you might identify me specifically from other things that I may have said on SE.

The definition depends on two parts. First, personal data is "information relating to an identified or identifiable natural person". Any "information" provided by a natural person is "related to" that person (as is any "information" that is about such a person). The second part defines "identifiable natural person", that is, who is an "identifiable person"? Every person can, in principle, be identified by reference to some label or description of fact about them, so every person is an identifiable person, under this definition. This means that every piece of text that refers to an individual (not even text which can identify the person) is "personal data". Obviously, any individual can be uniquely identified by some collection of identifiers; the problem is that the wording of the law does not explicitly say "using that supposed personal data". If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is.

Another term that the regulation defines and uses in a few places is "pseudonymization", which is defined as

the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person

The point of interest here is that this says that "personal data" which cannot be attributed to an individual is, nevertheless, still personal data. I think the most important part of the regulation is art. 6, which defines lawfulness of processing, especially para 4., which allows consideration to be given to safeguards such as pseudonymization.

Answer 2

It is possible that some forum posts might not be considered personal data for GDPR purposes, but the problem will always be the amount of time needed to make that determination for every single post.

The definition given in your question is from Article 4 (1). You will note that it includes economic, cultural or social identity. Almost anything posted by a forum user could count as that. For example, mere membership of a forum for fans of football would reveal part of their cultural and social identity.

One way some people have attempted to get around this is by deleting the person's name from the site, so that posts appear to be by "anonymous user" or similar. However, if any other user has used their name, it undoes that. If their posts contain their name, or any other identifying data, it undoes that. It may also be possible to identify them by combining the "anonymous" data that remains.

It may be possible to clear all that out with a lot of manual effort. Doing so is likely to be error prone, as it will need to consider other user's posts as well. As such, deleting all posts that the user has made is usually the best option, and the most likely to be compliant. It may also be prudent to remove other instances of their posts and user name, such as quotes or mentions. Hopefully your forum software has a feature to do this for you.