4

Forum posts and similar stuff: chat messages from chatlogs, etc.

According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered personal data under GDPR.

In this case, does a person have the right to request permanent removal of their posts from an Internet forum or from chatlogs?

  • This breaks the flow of the archived conversation and makes it difficult for readers to understand posts of other people that are not removed.

Does a person have the right to request removal of certain posts without removing their account?

  • Moderation problem; a person may request removal of posts that are stored as evidence of their past problematic behavior, in an effort to keep bordering the forum's rules without ever crossing the line to getting suspended.

If a person requests all their data deleted, is anonymizing their contributions enough?

  • I've seen an EU-based Internet forum that, on account deletion request, anonymizes all posts from this account (repleaces the author's nick with 'account deleted'), but leaves them in the archives. This still damages the flow of a past converstation, but not as badly as if the post was outright removed.
  • Other posts may contain the nick of the author of an anonymized post ('what @username said, ...'), making such anonymization questionably effective IMO?

Bottom line: If a user requests all their posts on an Internet forum deleted under GDPR, do I have to comply? Do I have to also censor other users' posts, which may contain this user's nickname and / or quotations of their posts?

Improve this question

1 Answer 1

Reset to default
8

Earlier this year, the Internet lawyer Arnoud Engelfriet wrote a blog post about exactly this topic. As it is written in Dutch, I will summarize it here:

As you also said, deleting posts breaks the flow of the archived conversation and it makes your archive incomplete. This is a problem for the freedom of expression and information. But Art. 17(3) GDPR includes an exception to the right of erasure for this situation. So posts do not need to be deleted.

However, profiles are not included in this exception. So they must be removed, but they can be pseudonymized. For example replace the username with user89432, and remove all details from the profile.

If other posts contain the nick of the author of an anonymized post, that is considered an journalistic, academic artistic or literary expression, so Art. 85 GDPR would apply, so the right of erasure does not apply to that.

Bottom line: you only have to pseudonymize the account, if that person wants to be removed from the forum.

Improve this answer
5
  • And what if it turns out some of their many posts contain their own nick? 'Cheers --nickname' Or worse even, if some of their posts contain data from which, if one takes context into account, one can infer their identity? Eg link to their facebook, though this can be far more subtle ('When I was a freshmen at universityname three years ago' + gender + names of two distinct professors they were training under from a different post may be enough to establish their identity) Problem is its nigh impossible to check all posts by hand for such situations
    – gaazkam
    Oct 7, 2018 at 17:24
  • The law is not ridiculous, so this is the danger of ever using your real name or saying anything that might lead a person to suspect who you really are.
    – user6726
    Oct 7, 2018 at 17:55
  • @gaazkam post can be considered personal data because of the reasons you mention. But you don't have to delete that because of Art. 17(3) GDPR. There can be other reasons why a post in unlawful, but (assuming you do not moderate all posts) you only have to remove unlawful content when you are attended to it. See Article 15 of Directive 2000/31/EC, and Article 2(4) GDPR which refers to that directive. So you don't have to check all posts in any situation.
    – wimh
    Oct 7, 2018 at 18:30
  • If a post contains someone's phone number, and he/she gets now unwanted phonecalls from strangers, then that would be a good reason to have that phonenumber removed from the post. The freedom of speech would not outweigh the personal interests of not getting called by strangers. But this does not apply to all personal data, and only if you are directly pointed to the post with (for example) the phonenumber.
    – wimh
    Oct 7, 2018 at 18:48
  • sounds like you need to run a check on posts to see if there is some outlier information that could lead to identity. for example the only owner of a red car of a certain make at a parking lot of a certain company might uniquely identify the person. so hiding behind user89432 isn't enough
    – kirill_igum
    Nov 3, 2020 at 21:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .