Suppose that a site, run as a free service, allows communication between users (a chat site). Suppose that the site also permits users to optionally upload text documents or images, which will be displayed to any other logged-in site user (but not the general public) who request it. The site does not display any personal info (PI) with such uploads, except possibly the user's user ID, which can be used to find the user's profile from that site, which the user can edit at any time. But a user could include PI in the document.

Suppose further that the site requires that any user, for every upload, certify that the use owns the copyright or has written permission to upload from the owner, adn that the user release the image or document under a permanent, non-exclusive license to the site operators, allowing them to display it on any part of they site they choose.

Suppose further that the site is subject to the GDPR or the CCPA or both, at least for some users.

If a user who made such an upload later demands its erasure by the cite, stating that it included PI, must the site erase it, or does the license work to permit the site to continue to display the uploaded content?

1 Answer 1


Rewind and reset please: What is your valid legal basis for collecting the personal data?

Let's look at this site as an example.

There is personal information (PI) in this answer. The words that I post are linked to my account. My account is directly tied to me. It contains an id no, a pseudonym, a list of IP addresses that I have used (as a Mod, I can see those, you can't) and it ties together all my questions, answers, comments and other activities, not just on this site but in all stack exchange sites I'm a member of.

So, what is Stack Exchange's lawful basis for processing all this PI? I'll give you a clue: it isn't consent - at least not exclusively.

In order to carry out these activities, Stack Overflow may rely on the following legal bases in order to process your personal data:

Where you have given us consent to process the information, which you can withdraw at any time.

Where the processing is necessary:

  • to carry out the contractual obligations in the Terms of Service or to provide the Products and Services you have requested
  • to comply with a legal obligation or to defend legal claims
  • to protect the public interest or vital interest of others
  • Where it is in our legitimate interests, or that of a third party to carry out the processing.

They then go on to enumerate their legitimate interests.

So, for this answer, SE legitimate interest is "Provide and optimize products and services" - the Q&A on the site are the "products and services". If I include PI in this answer, then the legal basis is legitimate interest, not consent: if I withdraw consent, they still have the legitimate interest.

If I ask SE to remove PI that I may have included in a post, then they are required to balance their legitimate interest against my right to privacy. This would have to be determined on a case-by-case basis.

Your situation is analogous.

Edit to address comments

This answer, like all questions and answers on SE, is licensed under CC-BY-SA 4.0. That license gives SE (and other people) specific rights, which are granted by consent, but by the terms of the license a consent that may not be withdrawn.

A contract cannot contract outside the law. GDPR gives an absolute right to withdraw consent where PI is concerned and consent is the basis for the processing. In those circumstances, the irrevocable part of the CC-BY-SA 4.0 is a void clause at law.

However, the legal basis for this answer, to the extent that it contains PI, is legitimate interest, not consent. Obviously, I consented implicitly when I provided the answer but that is not what gives SE the right to process any PI that it contains. If I withdraw my consent, SE must consider whether my right to do so override their legitimate interest, if so, if that contradicts a contract clause (like CC-BY-SA 4.0) too bad for the contract - the law says my personal information must be removed.

However, their legitimate interest probably does override my privacy concerns (or at least that case can be made). If so, then the CC-BY-SA 4.0 contract is not in conflict with the law and I am bound to it.

Also, by the tems of the question, the site (unlike SE) did not collect any personal data in connection with the upload. It does not retain any link between the uploaded content and any IP address or email address. The content contains PI if and only if the user directly included it.

Absolutely untrue.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

This answer is data. It related to me because it expresses my views. I am an identifiable natural person. Therefore it is personal data.

It is a common misapprehension that personal data has to be in some way ... personal, that is, about a person. That is not the definition that the GDPR uses. Their definition is that any data that can be linked to a person is personal data, even if it is not about that or any other individual person. So, for example, taking the first thing I found on Google Scholar: the article Generic Constitutional Law by David S. Law.

I haven't read it and I doubt that if I did, I would learn anything of a personal or private nature about Mr Law, although, hopefully, I would learn much about Generic Constitutional Law. However, under the GDPR, that article is personal data because it can be linked to Mr Law. And now, because of this answer, to me. And you.

Now as a result of Mr Law's rather random inclusion in this answer, he has the right to ask SE to remove this reference to him and his article. SE is obliged to consider his privacy rights (which are pretty low for a commercially published article he has claimed authorship of) and their rights in having this brilliant example in an answer to a question on their site and the rights of the many people who have used it under CC-BY-SA because of its undoubted brilliance. And they have to decide if his rights beat their rights. If he doesn't like their answer, he can take it up with the regulator.

  • "Their definition is that any data that can be linked to a person is personal data, even if it is not about that or any other individual person" — they use the word "related", not "linked". Data well could be linked, but still not related.
    – Greendrake
    Sep 2, 2021 at 7:05
  • @Greendrake I rephrased
    – Dale M
    Sep 2, 2021 at 8:42
  • The bit I quoted is still intact.
    – Greendrake
    Sep 2, 2021 at 13:36
  • Thank you, that clarifies things and I take your point. +1 One comment I still take issue with: "This answer is data. It related to me because it expresses my views." Suppose I write an essay on, say, data protection. I post it to the web through some site, but I do not sign it. The site does not have my name, email or other obvious means of linking the essay to me, and i used a cyber cafe so any IP address has no link to me. That essay expresses my views, but how is it personal data? No one else can reasonably relate it to an identifiable natural person. Sep 2, 2021 at 15:00
  • @DavidSiegel correct. If data cannot be linked to an identifiable person, it isn’t personal data.
    – Dale M
    Sep 2, 2021 at 22:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .