2

I have been a member of a website for 13 years and would like all of my old posts removed. I have contacted their support team however the experience has been dreadful:

  • it look a lot of back and forth messaging until they understood what I need
  • the support team is fairly disconnected from the tech team that can actually do it
  • in 9 months of continuous messaging there has been little to no progress and I feel I'm running 'round in circles

I had a quick at GDPR and these points don't apply:

  • the personal data your company/organisation holds is needed to exercise the right of freedom of expression;

  • there is a legal obligation to keep that data;

  • for reasons of public interest (for example public health, scientific, statistical or historical research purposes).

Is the website's refusal/failure to remove my personal data against GDPR ? What can I do about it ?

Improve this question
7
  • 2
    Are you talking about forum posts? Note that you have a misquotation of the GDPR in your post - public health etc are not examples of public interest, public interest is a valid reason on its own, with public health, scientific or historical research purposes or statistical purposes all being other valid reasons. Therefor it could be argued that, under Article 89, pseudonymisation of any forum posts to preserve context is a valid response to any removal request - this is indeed what StackExchange does. But that depends on this being forum posts (or the equivalent).
    – user28517
    Nov 25, 2019 at 2:31
  • 1
    Important aspects missing from this question include (a) the jurisdiction of the organization operating that website, and (b) the content of these posts, whether they contain personally identifiable information.
    – Peteris
    Nov 25, 2019 at 11:21
  • 2
    @MSalters just watch out on the word "citizen"; territorial scope makes no mention of citizenship.
    – Sam_Butler
    Nov 28, 2019 at 11:04
  • 3
    @Peteris pet peeve - "personally identifiable information" is not a term used or defined in the GDPR and can easily confuse the scope of its provisions since the term does have its own definition, which is different from "personal data" (and often narrower in scope).
    – Sam_Butler
    Nov 28, 2019 at 11:25
  • 2
    You haven't mentioned your location nor that of the company operating the website. If we assume that you are in Australia and they are in Japan then no this is not a violation of GDPR. Are you in the EU? Is the company?
    – phoog
    Nov 29, 2019 at 22:28

1 Answer 1

Reset to default
5

If the website's processing of your personal data is within the scope of the GDPR, then you have a qualified right to request the erasure of your personal data.

It is relevant whether:

  • the website operates within the EU;
  • the website is operated by a company established in an EU country;
  • the website aims to sell goods or services to people in the EU; or
  • the website is routinely processing the personal data of people in the EU (including non-citizens).

Furthermore, it is relevant whether your posts:

  • contain one or more identifiers from which you could be personally identified, directly or indirectly, including by only the administrators or owners of the website; and
  • by their content, directly reveal information relating to you.

For example, let's say you posted on a forum saying that "I am a keen supporter of socialism", and your personal email address was used to sign up to the website, then you would have revealed information about your political beliefs, which by reference to a username, the website owners could use to uniquely identify you by your email address. You would not necessarily have to have used your name.

If, for example, you posted something factual, like, "The Porsche 911 GT2 RS MR recorded the fastest lap time for a road-legal sports car on the Nürburgring," then it is only personal as long as it is associated with an identifier through which you could be identified. As such, the removal of the relationship could easily anonymise the post.

A data controller has an obligation to provide means by which the data subject can exercise the rights guaranteed under Chapter 3 of the GDPR. Article 17 grants the right to "erasure of personal data concerning him or her without undue delay" where the grounds under Art. 17 lit. 1 (a) to (f) are met. It may be relevant what the lawful basis of processing personal data was in the first place, such as in determining whether you can withdraw consent (i.e. you cannot withdraw consent if consent was not given), or in determining whether there is a right to object under Article 21 lit. 1. Derogations permissible under local implementing laws may provide for other exemptions or requirements to the right to erasure, so it is also important to determine the country of jurisdiction.

Improve this answer
3
  • 2
    "you cannot withdraw consent if consent was not the lawful basis of processing": wouldn't it be more precise to say that withdrawal of consent has no effect on the processor's ability to continue processing where there is another lawful basis for the processing? Even if there is some other basis, it's still possible to give and withdraw consent.
    – phoog
    Nov 29, 2019 at 22:32
  • I understand your point, but no, if you have not given consent, you cannot withdraw it. If consent has been given for that specific processing activity but is not the lawful basis, then yes, I suppose one could withdraw that consent without effect upon the lawful basis, but it would only likely be something like vital interests of another natural person where that would arise.
    – Sam_Butler
    Dec 3, 2019 at 11:57
  • @phoog I have edited anyway, but the comments are useful context.
    – Sam_Butler
    Dec 3, 2019 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .