Is a website OK with GDPR if it is not permitting the users to delete their posts?

Question

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely.

Is it against the right to erasure mentioned here as a part of GDPR?

Answer 1

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely.

That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE.

Is it against the right to erasure mentioned here as a part of GDPR?

No, it is not (otherwise StackExchange would be in rather big trouble).

The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4):

any information relating to an identified or identifiable natural person (‘data subject’)

If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data.

In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment.

---

So, in summary:

• A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized.
• The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit.

The StackExchange network, for example, covers this by allowing users to:

1. disassociate posts from their account
2. delete their account entirely (thus effectively disassociating all posts from personal information)
3. asking a moderator for redaction of personal data

Answer 2

Unless it is subject to one of the exemptions in paragraph 3, the website is non-compliant.