ToddZ noticed that an email log contained an address of a self-deleted user, raising concerns about data retention and GDPR compliance. ToddZ wondered if user deletion typically removes such traces and if the deletion should have been prevented by the Delete user max post age setting, which is set to 60 days. Moin clarified that the 60-day setting applies to staff deletions, not self-deletions, which are governed by Delete user self max post count. ToddZ suggested a clearer description for the Delete user max post age setting. Moin noted that email logs are deleted after 90 days by default, emphasizing that software compliance depends on its use. ToddZ acknowledged that their concern might stem from misinterpreting GDPR-related discussions, realizing that addresses are not immediately purged.
In reviewing the email log, I noticed that we would appear to be emailing an address that doesn’t have a user:
Research elsewhere shows that this was a recently self-deleted user. These log entries do predate the deletion – but there are no similar entries for other deleted users.
Just wondering how things work: does user deletion normally remove such traces?
This makes it sound like “yes”…
Thanks for the clarification, Moin. A small tweak to the Delete user max post age description could make it clearer: Don't allow staff to delete users whose first post in older than (x) days.
I’m still curious whether the address remaining in email logs is a glitch. Seems like that could be a GDPR/PII type of concern.
How long do you keep your email logs? By default those are deleted after 90 days (Delete email logs after days). I think it’s as HAWK often writes: it’s not the software that is compliant, but its use.
Yes, mine are kept 90 days – so I probably just don’t have more messages-to-deleted-users to see there.
I might have spent too much time reading threads about GDPR concerns, account deletion, etc., and took away an incorrect notion about addresses being immediately purged.
