internet gdpr
Does a user have the right to request their forum posts deleted?
<p>Forum posts and similar stuff: chat messages from chatlogs, etc.</p>

<p>According to <a href="https://eugdprcompliant.com/personal-data/" rel="nofollow noreferrer">https://eugdprcompliant.com/personal-data/</a> , <em>a person's social media accounts and their posts there</em> are considered personal data under GDPR.</p>

<p>In this case, does a person have the right to request permanent removal of their posts from an Internet forum or from chatlogs?</p>

<ul>
<li>This breaks the flow of the archived conversation and makes it difficult for readers to understand posts of other people that are not removed.</li>
</ul>

<p>Does a person have the right to request removal of certain posts without removing their account?</p>

<ul>
<li>Moderation problem; a person may request removal of posts that are stored as evidence of their past problematic behavior, in an effort to keep bordering the forum's rules without ever crossing the line to getting suspended.</li>
</ul>

<p>If a person requests all their data deleted, is anonymizing their contributions enough?</p>

<ul>
<li>I've seen an EU-based Internet forum that, on account deletion request, anonymizes all posts from this account (repleaces the author's nick with '<em>account deleted</em>'), but leaves them in the archives. This still damages the flow of a past converstation, but not as badly as if the post was outright removed.</li>
<li>Other posts may contain the nick of the author of an anonymized post ('<em>what @username said, ...</em>'), making such anonymization questionably effective IMO?</li>
</ul>

<p>Bottom line: If a user requests all their posts on an Internet forum deleted under GDPR, do I have to comply? Do I have to also censor other users' posts, which may contain this user's nickname and / or quotations of their posts? </p>

<p>Earlier this year, <a href="http://www.arnoud.engelfriet.net/arnoudengelfrietenglish.html" rel="noreferrer">the Internet lawyer Arnoud Engelfriet</a> wrote a <a href="https://blog.iusmentis.com/2018/04/03/geldt-het-vergeetrecht-onder-de-avg-ook-bij-forumdiscussies/" rel="noreferrer">blog post</a> about exactly this topic. As it is written in Dutch, I will summarize it here:</p>

<p>As you also said, deleting posts breaks the flow of the archived conversation and it makes your archive incomplete. This is a problem for the freedom of expression and information. But <a href="https://gdpr-info.eu/art-17-gdpr/" rel="noreferrer">Art. 17(3) GDPR</a> includes an exception to the right of erasure for this situation. So posts do not need to be deleted.</p>

<p>However, profiles are not included in this exception. So they must be removed, but they can be pseudonymized. For example replace the username with user89432, and remove all details from the profile.</p>

<p>If other posts contain the nick of the author of an anonymized post, that is considered an journalistic, academic artistic or literary expression, so <a href="https://gdpr-info.eu/art-85-gdpr/" rel="noreferrer">Art. 85 GDPR</a> would apply, so the right of erasure does not apply to that.</p>

<p>Bottom line: you only have to pseudonymize the account, if that person wants to be removed from the forum.</p>
