- An Internet forum logs their users' IP addresses for moderation purposes (fighting abusive sockpuppetry, temporary banning a dynamic IP address range in case of a spam attack, permanently banning static IP addresses in case of persistent toxic behaviors, etc)
- An abusive user request the deletion of their IP address from the logs under GDPR
- This seems to be in an effort to prevent the moderators from exercising the aforementioned tools, so that the user can abuse the forum undisturbed
- Do I need to comply?
Add a comment
|
1 Answer
No. Art. 17(1) GDPR lists conditions when erasure can be requested. None of the listed grounds would apply in this case.
However, you might have to explain why you process the data (for moderation purposes as you explained above), and why that is lawfully. In particular Art. 5 and Art. 6 need to be taken into account. In your case, processing will be based on Art. 6(1)(f):
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Even if the data subject would be a 9 year old child, the legitimate interests of you and other forum users outweigh the objection of the data subject.
Based on Art. 5, there will be a moment when the data has to be deleted. For example 1 year after the last login attempt.
