14

This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.

I will explain the best I can:

I'm a creative professional and frequent a forum dedicated to my industry. On the forum I have 2 accounts — one 'official' account under the name of my company, used to make official announcements etc, and a personal account under an anonymous username.

On the forum I had a discussion about a competitor company and made some personal comments about what I think about them. It's a small industry and the competitor company is very influential, so I wanted to keep these comments separate from my official company account and posted them from my anonymous personal account.

Weirdly (and this is what seems questionable to me) the forum owner has figured out that my personal account is linked to my professional account since they share an IP address, and has shared this info with my competitor. (As far as I know the competitor has a relationship with the forum owner because they advertise there regularly.)

Now my competitor knows that the anonymous account belongs to my company and can see my posts about them. The whole thing has caused a stir for me professionally since they are interpreting these comments as the official views of my company.

It seems like some law must have been breached during the sharing of this information? Does anyone have any insight?

I don't necessarily even want to do anything about this, but am just interested in the legality around it.

11
  • 2
    Are you located in the EU? – UweD Nov 24 '20 at 20:26
  • 2
    Yeah located in the UK – Michael Morgan Nov 24 '20 at 20:39
  • 1
    Note this may just be the competitor figuring that themselves without needing the cooperation from the forum owner, specially with it being a small forum. Sometimes relationships can be seen without needing technical data. – Ángel Nov 25 '20 at 1:52
  • 1
    Is it not plausible that the anonymous account belongs to an employee who posts from work? Or are you a sole trader? – Darren Nov 25 '20 at 8:16
  • 12
    @MichaelMorgan UK is no longer in EU. – Dan M. Nov 25 '20 at 13:08
9

It seems like some law must have been breached during the sharing of this information?

No. A scrutiny of your pseudonymous account would reveal that you used it for advancing your own business interests. That use forfeits the protections for which the GDPR was intended.

The Terms of Use very likely contain a provision to the effect of disclosing account details in the event of suspicious activity. A user's handling (like the one you describe) of two or more accounts in a forum tends to strengthen suspicions of misuse.

Article 6.1(c) of the GDPR also refers to processing (such as disclosure) pursuant to a controller's legal obligations. Although seemingly premature, it is possible that your competitor might have filed suit already (for instance, if your posts are false and/or egregious), in which case the forum/controller has no option but to comply with his requests for disclosure.

4
  • 12
    Acting in a business interest does not void all privacy protections. An IP address is still personal data in this context. Probably more importantly, processing of traffic data such as IP addresses has even stronger limitations under ePrivacy/PECR. Your last paragraph re legal obligations is spot on though. – amon Nov 25 '20 at 8:01
  • 1
    @amon "Acting in a business interest does not void all privacy protections". Most likely the forum controller ensured that his disclosure is proportionate to the circumstances. You give no specifics on the "even stronger limitations under ePrivacy/PECR", but in any case very likely these are outweighed by the factual capacity in which the pseudonymous account was used. US courts oftentimes use the expression "using the shield as a sword" to describe the impermissible situation where a party alleges "legal protection" for the sake of eluding his liability. – Iñaki Viggers Nov 25 '20 at 11:47
  • 4
    Business interests trump individual protection rights if and only if the two sides have been assessed and weighed by the controller in advance, and there is documentation of this process, and the contoller was correct in his conclusion that his business interest is more important than the interests of the data subject. - You cannot legitimate a previously unanticipated business interest in existing data. And not any business interest is a justification for any data use. – I'm with Monica Nov 25 '20 at 13:08
  • @I'mwithMonica There is no indication that the controller failed to assess & document the matter prior to making the disclosure to the competitor. The context provided by the OP nowhere suggests that the disclosure was excessive in any form either. – Iñaki Viggers Nov 25 '20 at 13:20
15

It seems like some law must have been breached during the sharing of this information?

Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR:

The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected.

If the website terms which you agreed to don't include this data matching, then that processing is not lawful.

The rest of Recital 50 is relevant and worth quoting in full:

If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations.

It seems to me that an anonymous account could reasonably expect that the "further processing" of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website.

Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.

11
  • 2
    Public interest is easy to establish insofar as the pseudonymous account did not disclose its conflict of interest, that is, its de facto affiliation to some competing company. That willful omission deprived [potential] consumers of the opportunity to weigh the bias or ulterior motive behind the negative publications. This is one aspect of what consumer & fair competition laws regulate. – Iñaki Viggers Nov 25 '20 at 12:11
  • 4
    @IñakiViggers You are of course correct that OP's sockpuppetry could also be seen as astroturfing and as misleading consumers, but this does not mean there would be any “public interest” basis for the forum to do this data processing. In this context, the “public interest” is fairly narrow. The details depend on EU member state (see Art 6(2) GDPR), but a non-public controller cannot generally claim a public interest. – amon Nov 25 '20 at 12:30
  • 1
    @amon "a non-public controller cannot generally claim a public interest". Public interest follows from consumer & fair competition laws, regardless of a controller's lack of standing on a claim of public interest. Additionally, recital 69 and art. 6.1(f) indicate the controller may justifiably advance the legitimate interest of a third party (here, the competitor who is the subject matter of the negative comments). – Iñaki Viggers Nov 25 '20 at 13:02
  • 1
    @IñakiViggers Yes, I agree that a legitimate interest could be a strong legal basis. Importantly, the legitimate interest doesn't have to be the controller's own interest, but can also benefit a third party. I also agree that there is a public interest at play, my point is just that this likely cannot serve as a legal basis. – amon Nov 25 '20 at 15:33
  • 1
    @aroth Did you read the last paragraph of my answer? There would also need to be some definition of sockpuppet: running your firm's account and having a personal account for your own participation as yourself is not necessarily sockpuppetry. – Andrew Leach Nov 26 '20 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.