2

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely.

Is it against the right to erasure mentioned here as a part of GDPR?

4

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely.

That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE.

Is it against the right to erasure mentioned here as a part of GDPR?

No, it is not (otherwise StackExchange would be in rather big trouble).

The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4):

any information relating to an identified or identifiable natural person (‘data subject’)

If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data.

In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment.


So, in summary:

  • A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized.
  • The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit.

The StackExchange network, for example, covers this by allowing users to:

  1. disassociate posts from their account
  2. delete their account entirely (thus effectively disassociating all posts from personal information)
  3. asking a moderator for redaction of personal data
-4

Unless it is subject to one of the exemptions in paragraph 3, the website is non-compliant.

  • If I have posted a pancake recipe, why would GDPR grant me the right to delete it? There's nothing personal in it. – Greendrake Jan 7 at 4:09
  • @Greendrake - 'Greendrake' is personal information - if that is attached to your pancake recipe then that makes the recipe subject to GDPR. Further, if you refer to 'my Aunt Betty's pancakes' in you recipe then that is personal information of your Aunt Betty (assuming you actually have an Aunt Betty). – Dale M Jan 7 at 4:22
  • 1
    This is wrong (as exemplified by this very site, which generally disallows deleting your own posts). – sleske Jan 7 at 8:15
  • 1
    We don't know that SE has been found to be compliant with GDPR. – user6726 Jan 7 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.