gdpr
Do pastebin sites have to delete content on request?
<p>A pastebin site, hosted in the US, allows users to post data anonymously. However, its intended purpose is for sharing information about one's computer, including the username (which is sometimes PII). Under GDPR, is the site owner required to allow users to delete posts, even though there's no way to verify who posted? What if all posts are automatically deleted after one day or some other period of time?</p>

<p>Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies.</p>
<p>This is a case for Art 11 GDPR: processing which does not require identification.</p>
<ul>
<li>The pastebin site is not required to collect identifying info just in order to facilitate later deletion.</li>
<li>If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though.</li>
<li>But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again.</li>
</ul>
<p>In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste.</p>
<p>None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader.</p>
<p>Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context.</p>
<p>You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.</p>
