For over a year, I'm trying to get "wordpress.org" to delete my personal data from their bugtracker (the pseudonym is linked to my full personal address).

According to https://wordpress.org/about/privacy/ The website states GDPR compliancy and appropriate rights are theoretically granted. There is no legal or even practical reason not to (at least) anonymize the data in question. No payments or contracts are involved.

Until today I have written about 7 mails to 4 different receivers including but not limited to the address listed in the above privacy statement, starting from August 2019. Without any reply at all.

I tried opening tasks in their bugtracker and request information about the legal holder of the domain or a contact who may be able to fulfill my request. All my requests have been blocked and deleted immediately - even one of my domains has been blocked completely.

Wordpress is putting preasure on avoiding me as hard as possible even tho I have written most polite messages and acknowledging integrity of their systems.

What could I possibly do now to get my data erased or anonymized?

  • 2
    Find your local data protection officer and inform them of the violations. Also, get a lawyer and send some official mail. Usually that makes companies react quite fast. – Polygnome Oct 1 at 19:07

If a data controller fails to fulfil your data subject rights, lodge a complaint with your data protection authority. In Hamburg, the appropriate form is here. However, they are not required to investigate your complaint.

Independently from a complaint, you could consider suing Wordpress for compliance – Automattic has a subsidiary in Ireland so this might actually be feasible. I'm not quite sure though that Automattic is indeed the data controller for wordpress.org, as opposed to the .com domain – the privacy policy isn't quite GDPR compliant.

While your GDPR Art 17 Right to Erasure might not apply in this case, there's a definite GDPR violation because the data controller failed to respond to your request within a month as per Art 12(4). That your posts on the bugtracker were deleted doesn't look like an issue in this context, what does matter is that they didn't respond to emails to the addresses mentioned in their privacy policy.

Whether you have a right to erasure depends on the legal basis for storing your data. In general, you have a right to erasure if:

  • the data is no longer necessary;
  • processing is based on consent (because you can always withdraw consent); or
  • processing is based on a legitimate interest and they have no overriding legitimate grounds to continue processing despite your objection (Art 21).

The data is still necessary to identify you for your actions on the bugtracker, but depending on your particular situation you may be able to object successfully and force them to anonymize your posts.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.