privacy gdpr
Why is my GDPR (a.17) request not fulfilled?
<p>For over a year, I'm trying to get &quot;wordpress.org&quot; to delete my personal data from their <a href="https://core.trac.wordpress.org/" rel="nofollow noreferrer">bugtracker</a> (the pseudonym is linked to my full personal address).</p>
<p>According to <a href="https://wordpress.org/about/privacy/" rel="nofollow noreferrer">https://wordpress.org/about/privacy/</a> The website states GDPR compliancy and appropriate rights are theoretically granted. There is no legal or even practical reason not to (at least) anonymize the data in question. No payments or contracts are involved.</p>
<p>Until today I have written about 7 mails to 4 different receivers including but not limited to the address listed in the above privacy statement, starting from August 2019. Without any reply at all.</p>
<p>I tried opening tasks in their bugtracker and request information about the legal holder of the domain or a contact who may be able to fulfill my request. All my requests have been blocked and deleted immediately - even one of my domains has been blocked completely.</p>
<p>Wordpress is putting preasure on avoiding me as hard as possible even tho I have written most polite messages and acknowledging integrity of their systems.</p>
<p>What could I possibly do now to get my data erased or anonymized?</p>

<p>If a data controller fails to fulfil your data subject rights, lodge a complaint with your data protection authority. In Hamburg, the appropriate form is <a href="https://datenschutz-hamburg.de/beschwerde/" rel="nofollow noreferrer">here</a>. However, they are not required to investigate your complaint.</p>
<p>Independently from a complaint, you could consider suing Wordpress for compliance – Automattic has a subsidiary in Ireland so this might actually be feasible. I'm not quite sure though that Automattic is indeed the data controller for wordpress<i>.org</i>, as opposed to the .com domain – the privacy policy isn't quite GDPR compliant.</p>
<p>While your GDPR Art 17 Right to Erasure might not apply in this case, there's a definite GDPR violation because the data controller failed to respond to your request within a month as per Art 12(4). That your posts on the bugtracker were deleted doesn't look like an issue in this context, what does matter is that they didn't respond to emails to the addresses mentioned in their privacy policy.</p>
<p>Whether you have a right to erasure depends on the legal basis for storing your data. In general, you have a right to erasure if:</p>
<ul>
<li>the data is no longer necessary;</li>
<li>processing is based on consent (because you can always withdraw consent); or</li>
<li>processing is based on a legitimate interest <em>and</em> they have no overriding legitimate grounds to continue processing despite your objection (Art 21).</li>
</ul>
<p>The data is still necessary to identify you for your actions on the bugtracker, but depending on your particular situation you may be able to object successfully and force them to anonymize your posts.</p>
