Data backups, data loss, the GDPR right to be forgotten, and timing

Question

This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss.

I am considering creating a web app that allows users to play a game against one another in a play-by-email format. Users would register accounts, and having registered accounts they would be able to play the game in question against other registered users. They would also be able to post messages to each other.

This would be a free service and would be run by me as a hobby. It would not be a for-profit enterprise.

It is clear that such a web app would be subject to various provisions of the GDPR, as I would be gathering some identifying or personal information about users:

• Users registering would be required to supply a pseudonymous username to identify themselves. This will typically be personally identifying information, since it is commonplace for people to consistently use a chosen pseudonym/handle across their online presence.
• Users may post messages to one another. The contents of these messages cannot be guaranteed not to include personal information volunteered by the user, so pessimistically they must be presumed to all be (in their entirety) personally identifying information.

The GDPR provides that data subjects (in this case, the users of the web app) have a "right to be forgotten". This means that the user can contact the data controller (me) and demand that their data be deleted. It is my understanding that they can do this via any reasonable medium; for example, they could send me an email or they could post a message on the site itself, in a place where they could expect the demand to be seen and responded to. I daresay that the moment they make such a post, I am in receipt of the demand and legally required to act on it. "Acting on it" in this specific case would probably entail deleting all messages posted by the user, and anonymizing the user's username on the site.

What happens if the following chain of events occurs:

1. A user registers to the site, using the pseudonym "Bob".
2. Bob engages in various activities on the site, causing personal information to be stored in the site's database.
3. I make a routine backup of the site's database. This includes Bob's data from step 2.
4. I go to bed.
5. Bob posts on the site, demanding that their data be deleted under the terms of the GDPR's "right to be forgotten".
6. The site's database fails catastrophically and all of the data in the live system is irrevocably lost (or it is in any case put beyond my technical capacity to repair it).
7. I get up.
8. I notice that the site is down and that the database has been trashed.
9. I restore the site's database, allowing it to resume operation. Bob's activity from step 2 is restored, but his demand to be forgotten from step 5 is not restored, because it occurred after the database was backed up and I am not aware of it.
10. Two months later, Bob notices that his data remains on the site, but that I appear to have deleted his demand that I delete that data.
11. Bob complains about me to some statutory body or other that has a remit to handle such complaints.

Bob's action at step 5 creates an obligation on my part to delete all of Bob's data. Per other questions on this site (for example this one), I do not necessarily have an obligation to delete Bob's data from the backup that was created at step 3; however I do have an obligation to ensure that Bob's data is put beyond use should such a backup be restored to the live system. I have failed to act on that obligation. What potential consequences exist?

I would like to reiterate at this point that I am a "one-man band", with some technical expertise but no legal expertise whatsoever.

Answer 1

The GDPR provides that data subjects (in this case, the users of the web app) have a "right to be forgotten". This means that the user can contact the data controller (me) and demand that their data be deleted.

More or less, but there are some details. In my view the term "right to be forgotten" is unfortunate, because it raises expectations that the GDPR does not fulfill. What there is, is a right to have personal data (PD) deleted or anonymized, but there are a number of exceptions where the right does not apply.

The right to deletion is provided for in GDPR Article 17. (Recitals 65 and 66 are also relevant.) There are six points in Article 17(1), and only when at least one of them applies is deletion (erasure) requited. Probably the most common in the sort of situation described in the question is: 17(1)(b) which reads:

the data subject [user] withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

But note that point (b) applies only when "there is no other legal ground for the processing". Points (a), (c), or (e) might well also be relevant in the situation described in the question.

However, Article 17(3) lists five exceptions (points (a) to (e)). If any of these apply, the Data Controller (DC) is not required to delete the data as requested by the DS. Particularly relevant may be point (a) of Article 17(3), which reads:

for exercising the right of freedom of expression and information;

Where a message posted to the site is part of a public exchange of messages, and removing it would render the messages of others unclear so that their expression is hindered, this point may apply and deletion may not be required.

Now to come to the specific situation in the question.

The result of the chain of events is that Bob has made a request for erasure, but through no intent of anyone's that request was lost and the DC never received it. To Bob it may seem as if it was intentionally ignored.

If the DC posts an announcement on the site that posts between Time X and Time Y may have been lost, Bob may well see it and know that a re-send of the article 17 request would be needed.

Bob would in any case be well advised to send a follow-up request/demand. If Bob does this the DC will presumably comply, or if an exception applies, tell Bob of the exception, including any needed supporting information. Problem solved.

But Bob may not make a 2nd request. If Bob complains to a Data Protection Authority (DPA) the DPA may forward this to the DC. In which case the DC will presumably respond that there is no record of the request having been made, and treat it as a new request. If the DPA is at all reasonable, and there is no indication that this DC is in the habit of ignoring Article 17 requests, that may well end the matter. If Bob provides the exact timestamp of his article 7 request, the DC may be able to trace the DB crash and restoration, which should settle the matter.

Bob's action at step 5 creates an obligation on my part to delete all of Bob's data.

That is stating the matter overly strongly. My understanding ism that if Bob has included personal information in forum posts or other public posts to the site, and others have then quoted this, the DC has no obligation to edit other people's posts to remove info about Bob. Aside from that, various exceptions may apply, described in Article 17(3). If one does apply, the DC has no such obligation. But in any case the DC should acknowledge the request (once the DC learns of it) and if the DC thinks an exception applies, should notify Bob of the exception and why it applies.

It is not yet clear to what extent the DC is obliged to remove Bob's info from stored backups, or to somehow ensure that if a backup is restored, Bob's data is not restored with it, or else is promptly removed again. Bob's obligation does not extend to cases where unreasonable time and effort would be required, considering the nature of the data involved.

I cannot speak to how reasonable or unreasonable the DPA might be. My understanding is that individual complaints against non-commercial sites are not usually a high priority at DPAs, but that may not always be correct. If things get to that point, the DC may well want to consult a lawyer with expertise in such matters.