+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: [Policy Q] GDPR question on posts (/showthread.php?tid=5853773)
GDPR question on posts - Autist - Jun 24, 2018
I just came back from a short vacation and plan on going out of the country for a month soon so I haven't been up to date on the forums new rules and stuff
Questions
1) If a user posted information on the forum that could possibly lead to your identity what would happen?
2) If you posted information that could possibly lead to id'ing you and the thread is locked preventing you from changing it what is to be done?
3) What about banned accounts? Banned accounts that have posted information of users, what is to be done about them?
RE: GDPR question on posts - Warbiest - Jun 25, 2018
(Jun 24, 2018 10:07 PM)Bart Allen Wrote: 1) If a user posted information on the forum that could possibly lead to your identity what would happen?
Generally, not much. I don't think it's against forum rules right now (not too sure) but it's highly discouraged. Staff might remove explicit PII (personally identifiable information).
But it remains your own responsibility as to what you post on a public forum. The largest change the GDPR brings about is how Hackforums informs its users about the data is collects and saves, not what it does with it.
(Jun 24, 2018 10:07 PM)Bart Allen Wrote: 2) If you posted information that could possibly lead to id'ing you and the thread is locked preventing you from changing it what is to be done?
Generally, not much. Although Hackforums doesn't have a clear policy on UGC (user generated content) right now, there's no real responsibility for Hackforums to remove PII from its public forums. We'll have to wait and see how Hackforums decides to handle UGC and PII.
(Jun 24, 2018 10:07 PM)Bart Allen Wrote: 3) What about banned accounts? Banned accounts that have posted information of users, what is to be done about them?
Same as above. However, users have lost access to these accounts which makes it a bit more troublesome. One options would be the removal of the account name, which is the only potential PII on the account. The posts can be preserved just fine, because it's in the interest of the general public. Again, Hackforums policy isn't quite clear on this as of yet and we'll have to wait and see what'll happen.
RE: GDPR question on posts - Omniscient - Jun 25, 2018
Quote:1) If a user posted information on the forum that could possibly lead to your identity what would happen?
It's going to depend on the circumstance. Are you in EU? Is the data related to a marketplace deal? Are you unable to edit the post yourself?
Quote:The largest change the GDPR brings about is how Hackforums informs its users about the data is collects and saves, not what it does with it.
Export feature provides the data saved which the only PII we store based on GDPR description is your account email and IPs in logs for various HF features. It's minimal. And we do zero marketing with that information.
Quote:One options would be the removal of the account name, which is the only potential PII on the account.
And we may start creating anonymizing tools but realize that it's very possible closed or banned accounts are part of activity we have to monitor for legitimate legal reasons which allows us not to alter that data. GDPR intent is to prevent us from being bad actors where we sell your data or use it for marketing. We do none of that.
At this point some of our language has to be changed but I think as a policy what we have and the tools we have offered bring us very close to full compliance.
One weird thing I'm looking into is the whole Data Portability thing. I'm reading that part of that is allowing tools for members to export their account to be used elsewhere. I really do not understand why that's there or how we should do it since you just have to enter your email and create a password to join a MyBB site. If they believe we have to allow password export in plain text format so that it can be imported somewhere else that's stupid.
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/
RE: GDPR question on posts - Warbiest - Jun 25, 2018
(Jun 25, 2018 07:28 AM)Omniscient Wrote: One weird thing I'm looking into is the whole Data Portability thing. I'm reading that part of that is allowing tools for members to export their account to be used elsewhere. I really do not understand why that's there or how we should do it since you just have to enter your email and create a password to join a MyBB site. If they believe we have to allow password export in plain text format so that it can be imported somewhere else that's stupid.
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/
You don't have to worry about data portability at all. It's does not cover anything like forum posts.
That part is pretty much specifically written for companies that collect vast amounts of personal data, such as habits, website visits. Hackforums does none of this.
The posts that are being made by users do not fall under personal data given to controller since that is UGC. Personal data would indeed be account e-mail and maybe a history of contracts from the new contracts system (but even that is far-fetched).