This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss.
I am considering creating a web app that allows users to play a game against one another in a play-by-email format. Users would register accounts, and having registered accounts they would be able to play the game in question against other registered users. They would also be able to post messages to each other.
This would be a free service and would be run by me as a hobby. It would not be a for-profit enterprise.
It is clear that such a web app would be subject to various provisions of the GDPR, as I would be gathering some identifying or personal information about users:
- Users registering would be required to supply a pseudonymous username to identify themselves. This will typically be personally identifying information, since it is commonplace for people to consistently use a chosen pseudonym/handle across their online presence.
- Users may post messages to one another. The contents of these messages cannot be guaranteed not to include personal information volunteered by the user, so pessimistically they must be presumed to all be (in their entirety) personally identifying information.
The GDPR provides that data subjects (in this case, the users of the web app) have a "right to be forgotten". This means that the user can contact the data controller (me) and demand that their data be deleted. It is my understanding that they can do this via any reasonable medium; for example, they could send me an email or they could post a message on the site itself, in a place where they could expect the demand to be seen and responded to. I daresay that the moment they make such a post, I am in receipt of the demand and legally required to act on it. "Acting on it" in this specific case would probably entail deleting all messages posted by the user, and anonymizing the user's username on the site.
What happens if the following chain of events occurs:
- A user registers to the site, using the pseudonym "Bob".
- Bob engages in various activities on the site, causing personal information to be stored in the site's database.
- I make a routine backup of the site's database. This includes Bob's data from step 2.
- I go to bed.
- Bob posts on the site, demanding that their data be deleted under the terms of the GDPR's "right to be forgotten".
- The site's database fails catastrophically and all of the data in the live system is irrevocably lost (or it is in any case put beyond my technical capacity to repair it).
- I get up.
- I notice that the site is down and that the database has been trashed.
- I restore the site's database, allowing it to resume operation. Bob's activity from step 2 is restored, but his demand to be forgotten from step 5 is not restored, because it occurred after the database was backed up and I am not aware of it.
- Two months later, Bob notices that his data remains on the site, but that I appear to have deleted his demand that I delete that data.
- Bob complains about me to some statutory body or other that has a remit to handle such complaints.
Bob's action at step 5 creates an obligation on my part to delete all of Bob's data. Per other questions on this site (for example this one), I do not necessarily have an obligation to delete Bob's data from the backup that was created at step 3; however I do have an obligation to ensure that Bob's data is put beyond use should such a backup be restored to the live system. I have failed to act on that obligation. What potential consequences exist?
I would like to reiterate at this point that I am a "one-man band", with some technical expertise but no legal expertise whatsoever.