gdpr website
Is a website OK with GDPR if it is not permitting the users to delete their posts?
<p>Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely.</p>

<p>Is it against the <strong>right to erasure</strong> mentioned <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">here</a> as a part of GDPR?</p>

<blockquote>
  <p>Think of a website that has gives no option for the users to delete
  what they have posted -but still the users can delete their account
  completely.</p>
</blockquote>

<p>That's easy - this is exactly how all StackExchange sites (including this one) work :-).
See for example: <a href="https://meta.stackexchange.com/questions/5221/how-does-deleting-work-what-can-cause-a-post-to-be-deleted-and-what-does-that">How does deleting work?</a> on meta.SE.</p>

<blockquote>
  <p>Is it against the right to erasure mentioned here as a part of GDPR?</p>
</blockquote>

<p>No, it is not (otherwise StackExchange would be in rather big trouble).</p>

<p>The <strong>"right to be forgotten" is subject to limitations</strong>. Most importantly, <strong>it only applies to <em>personal data</em></strong>. Personal data is defined as (<a href="https://gdpr-info.eu/art-4-gdpr/" rel="noreferrer">GDPR, art.4</a>):</p>

<blockquote>
  <p>any information relating to an identified or identifiable natural
  person (‘data subject’)</p>
</blockquote>

<p>If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. <a href="https://www.itgovernance.eu/blog/en/the-gdpr-what-exactly-is-personal-data" rel="noreferrer">The GDPR: What exactly is personal data?</a>), but "personal data" is things about <em>you</em> (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data.</p>

<p>In addition to that, <strong>even personal data <em>may</em> be retained if the data controller has a need to retain that information</strong>. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment.</p>

<hr>

<p>So, in summary:</p>

<ul>
<li>A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized.</li>
<li>The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit.</li>
</ul>

<p>The StackExchange network, for example, covers this by allowing users to:</p>

<ol>
<li>disassociate posts from their account</li>
<li>delete their account entirely (thus effectively disassociating all posts from personal information)</li>
<li>asking a moderator for redaction of personal data</li>
</ol>
