5

If my site ToS has this:

By submitting data to the this site, you certify that the data is not of a nature that would cause me to have any special obligations under applicable law.

And someone from Europe submits personal information, am I obligated to remove it?

Improve this question
15
  • 1
    @phoog it allows users to upload arbitrary text, but it's intended for one very narrow purpose that does not include personal information. Unfortunately it isn't feasible to validate the data. Users are supposed to only use one particular client program, but it will be open source, so there's no way to technologically enforce that.
    – Someone
    Aug 29, 2022 at 7:27
  • 1
    You do not have to validate anything. You just have to comply when users want it deleted. The easiest way would be to give users the option to edit or delete all of their data themselves and not keep (technically not required) backups. Problem solved.
    – nvoigt
    Aug 29, 2022 at 8:39
  • 1
    Do you imagine that the GDPR prevents the storage of personal data altogether, or are you asking whether you would have to remove it on request from the user who uploaded it?
    – phoog
    Aug 29, 2022 at 10:59
  • 2
    "Without something like that I could not distinguish between Alice requesting that I take down her data for privacy and Bob requesting that I take down Alice's data maliciously": whatever you do, don't make your site available to the public without hiring a lawyer. But consider the possibility that Bob posts Alice's PII and Alice requests its deletion. In that case I suppose you may have to delete it. If that's true, then the identity of the poster doesn't matter, only the identity of the person whose PII it is.
    – phoog
    Aug 29, 2022 at 16:14
  • 2
    @Someone a service that allows to share random stuff anonymously on the internet is certainly a very bad idea full of legal pitfalls. Privacy is probably the last of your potential issues.
    – Eike Pierstorff
    Aug 29, 2022 at 17:58

3 Answers 3

Reset to default
14

This question shows a misconception of GDPR.

  • GDPR creates an obligation not just towards the data subject but also towards the authorities of the relevant state(s). The data subject cannot waive your responsibility to safeguard data, document internal processes, etc.
  • GDPR is not a blanket ban on the handling of personally identifying information (PII). Informed consent is one of the ways to get permission to process and store this data. If your data subjects are prepared to give your sweeping permissions, ask for consent (informed, revocable, etc.), document the consent, and go from there.
  • The data subject does not get to decide what classification data falls under. If you collect, say, medical data, then you are subject to increased restrictions and safeguards.
Improve this answer
15
  • Indeed, it's hard to imagine how one could argue that a user uploading arbitrary text to a website somehow withholds permission for the website to process the text.
    – phoog
    Aug 29, 2022 at 10:57
  • 5
    @phoog, GDPR requires that the website clarifies what it does with the text (e.g. third party use, user profiling, ..., or mere storage without further processing). So the scope of consents should be made explicit.
    – o.m.
    Aug 29, 2022 at 12:12
  • 2
    @phoog Undere the GDPR consent must be explicit, it may not ever be implied by uploading information. It must also be revocable.It must also be freely given, and the provision of services should not depend on such consent.
    – David Siegel
    Aug 29, 2022 at 13:04
  • 6
    For example, say you let visitors to your web site post an anonymous message (similar to the old guest books on 1990's web sites). The site makes it clear that such messages will be publicly visible. One visitor posts their name. What obligations does the GDPR place upon you? Do you have permission to have it, because the site said it would be public? I suppose you must have a process in place to delete messages upon request?
    – Corrodias
    Aug 29, 2022 at 15:43
  • 1
    @DavidSiegel but note that consent may be "a clear affirmative action" that "signifies agreement to the processing of personal data," so as long as the uploader is properly informed, the fact of the upload may be a component of the consent.
    – phoog
    Aug 29, 2022 at 18:28
10

Yes. Assuming you fall under the GDPR.

You are by law required to remove it if requested (and no other law overrides this, for example if you need it for billing or taxes or other legal obligations).

The fact that your user broke your terms of service is between you and your user and cannot undo existing laws. You can do whatever you do when users break your terms of service, but you do not get to break the law by keeping the information.

Compare for example if someone sells you stolen goods. The fact that they lied and told you the goods were legit does in no way mean you get to keep them. Someone making false claims does not mean the laws around it are null and void. They still exist and they still take precedence over "but they said so!".

Improve this answer
3
  • 7
    "You are by law required to remove it if requested" This is true only if none of the exceptions in the GDPR itself applies, and they are not limited to "if you need it for billing or taxes or other legal obligations"
    – David Siegel
    Aug 29, 2022 at 12:56
  • @DavidSiegel Also billing and legal obbligations ARE valid exceptions, since their certainly fall under "legitimate business interest&need". Most countries force you to store invoices for something like a decade, invoices do contain PII and no amount of GDPR will force someone to delete their invoices since they are legally obligated to keep them.
    – GACy20
    Aug 30, 2022 at 6:37
  • @GACy20 Yes, quite true, That is why I wrote "...not limited to..."
    – David Siegel
    Aug 30, 2022 at 13:03
1

You cannot make your users waive their legal rights for no good reason.

It's still a good idea to state in the ToS that users are not allowed to submit PII in certain forms. Such submissions can still happen of course, but having a "no private data allowed" rule gives you a good reason to remove the problematic content without upsetting your users.

"Letting anyone delete their own content" doesn't solve the problem, user A could use your service to post B's personal data, and you'll still have to deal with B's complaint.

"Letting anyone delete any content" is so prone to abuse that it'll be probably easier to deal with a GDPR complaint once in a while, than to explain to users why their data is gone.

Auto-deleting the content after a few days will be a much cleaner strategy with the same effect of practically avoiding GDPR complaints.

And BTW, you actually want to collect some private data about your users if you host their data, even for a few days. If user A posts B's credit card info, it will not be sufficient for B to have it removed. If B's information was used to steal their money, and B finds this information on your site, you'd better have A's PII when the police shows up.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .