GDPR countdown and compliance

This is sloppy language of the author and not a quote of the minister.

Translated from Wat zijn de risico’s bij overtreding van de AVG? Deel 1: boetes - ICTRecht

Considerations when imposing a fine

From the GDPR it also follows that a supervisor must carefully consider whether the imposition of a fine is appropriate (effective, proportionate and dissuasive) for the violation. When it comes to a small infringement, you can also opt for a reprimand instead of a fine. Supervisors may draw up their penalty policy at their discretion. The supervisory authority must in any case take into consideration the following considerations in its consideration (whether or not to impose a fine and the amount of the fine):

  • The nature, severity and duration of the infringement. This involves looking at the number of affected parties and the extent of the damage suffered by them;
  • Whether the controller or processor acted deliberately or negligently;
  • The measures taken to limit the damage;
  • Previous infringements by the controller or processor;
  • To what extent has the co-operation been granted to the regulator to remedy the infringement and to limit the damage;
  • Which category of personal data is concerned;
  • How the supervisor has been informed of the infringement, in particular whether the controller or processor himself has made a report;
  • Compliance with a previously imposed corrective action;
  • Whether the controller or processor is affiliated with approved codes of conduct or certification mechanisms;
  • Other aggravating or mitigating factors.

Well, we’ll see how it works in practice and how the other countries are treating this in the coming weeks I guess.

But keep in mind the Minister also is not all powerful in this.

Thank you for the information regardless.


You can use the Legal Tools Plugin to do this.

As @HAWK points out, the ability to do this is not determinative of compliance.

The GDPR is mostly about how you run your forum, rather than the software per se. It’s not that how the software is built is irrelevant, it’s that it shouldn’t be your primary focus.

That said, I completely understand why folks are anxious about the GDPR. It’s not irrational to feel anxious about it, particularly if you’re a small outfit.

If anyone has any remaining specific concerns about the GDPR and Discourse that have not been covered already please raise them here and we can deal with them together.

Whatever it is, we can fix it. But please be specific and read up on what has already been covered first.


We have a lot of people beeing anxious about that *** GDPR law here in Germany. There are lots of those admonish lawyers waiting for the law and rubbing their hands. The government did nothing in front of to prevent from those lawyers to admonish for every small error. So it´s a big business, also for the government. They will earn a lot of money when big companies getting sued.

I am happy about you guys taking that matter seriously!

Please note that (contrary to how this would be in e.g. the US), the fines will not be paid to the plaintiff, but to the state authority. This severely limits the incentive to file bogus lawsuits.

Yes, you can sue based on a data-breach, but that was already the case afaik.

Then they probably shouldn’t exist. I also can’t run a cocaine farm due to regulation. I won’t shed a single tear.


So, to clarify the current status for compliance regarding the issues I raised in the first post:

Consent to Updated Privacy Policy / Terms of Service :white_check_mark:

We can use @angus’s amazing custom wizard to construct a consent to new privacy policy and ToS (which can state that emails are used to “notify you about posts and other activity on the forum”):

IP Addresses :hourglass: :white_check_mark:

Sounds like a ton of work was done with regards to IP addresses and will be part of an upcoming 2.0 or 2.1 build so we’re almost there:

Data Portability :white_check_mark:

We can use @angus’s Legal Tools Plugin to allow users to download all collected data about themselves.

And perhaps some of this work can go into the normal Download button handler after the IP addresses issue is fully resolved.

Great job everyone! :clap: :clap: :clap:


How about handling all cookies that are present at Discourse including third-party cookies:

This has been discussed in some depth here:

tl;dr: Cookie use in standard Discourse is either non-user-specific or or falls under the ‘legitimate Interests’ basis of data processing and storage, rather than consent. If you’re using third-party services, such as analytics or ad-based services, you may need to obtain consent. In the topic I linked to, there’s some examples of using purpose-built services to obtain consent for cookie use.

To your specific point about notices, you can provide a statement about your cookie use in your privacy policy, in a globally pinned topic and / or in a banner.


The Discourse forum is shutting down due to GDPR.

I don’t think it’s a good measure to shutdown the forum because GDPR, in fact, moving to reddit does not solve the problem at all.

GDPR is here to stay, and we need to learn to be complaint. And the Discourse community is doing their best to prepare the platform. Just my view.


Wouldn’t it be beneficial to everyone if the admin shared an anonimized version of the requests and perhaps we could help agree an appropriate response together? We could then understand the result and ultimately develop a standard response to such requests? This is going to be repeated on forum after forum and it’s best we don’t reinvent the wheel every time?

I would also like to understand if these requests are from an individual or an agency?


Wow, embedded in that thread are two incredibly useful and insightful articles.

One from LinkedIn, where a PwC consultant, presumably a lawyer, has kindly drafted a ‘worst case’ letter that you might receive so you can prepare how to respond in the ‘worst case’ (please don’t send this to your forum admins, be nice :wink: ):

(you will note the article has a lot of good feedback and a number of good samaritans have translated it into other languages including Dutch & Greek, links in the comments)

Also, here is someone’s proposed response:


It doesn’t solve the problem, but it does shift the problem to someone else. Unfortunately as that admin pointed out, it makes your privacy as a user worse and of course and limits your agency as an admin (reddit can do anything they want with content you post on their site). In this case the admin was afraid of theoretical fines to the point where they thought the trade-off was worth it.

Seems a bit extreme because at this point there’s no indication that the GDPR can be used maliciously to fine someone acting in good-faith to the point of financial ruin… there’s just a lot of fear-mongering.


Totally agree. And who was this troll? It’s very different if the EU’s legal department is calling you up or if it’s a layman who has a sketchy interpretation of the law.

I believe the admin should simply be more thick skinned, do what is reasonable and see how things go. Arguably, he doesn’t need any legal counsel unless he’s summoned to court. Would the troll really go so far? And even if it got to that stage, some legal eagle with a reputation to enhance is going to offer pro bono support because it will be a headline grabbing test case that will attract more business … that is if there is any case to answer!

1 Like

Whether the interpretation was sketchy or not is not the point, I think. The question is rather what the data protection agency would do with this case.

The (sample) letter is “merely” asking for all the information that the user is entitled to. The “dangerous” part is what the troll is then going to do with that information (or the absence of a reply): writing a letter of complaint to the data protection authority. That letter would complain either

  • about the complainee not providing the required information or
  • about the complainee not adequately protecting the complainants personal data.

If that letter of complaint ever gets sent (and one might doubt that it will, which is why I find it particularly frustrating that the troll “won” so easily) one might wonder whether such a rather obvious troll case will be prioritized in any way by the authority given that they will have to deal with some serious real cases and given they will make sure to show to the public that their work “makes sense”. Even if/when they deal with the case they will surely consider the severity of the case so that I don’t see how this could lead to any significant fines as long as the forum owner made reasonable efforts to comply with the law. And as has previously been mentioned in the other topic, this seems to be the core of the problem: the forum admin simply couldn’t be bothered. So from that stance, it probably makes sense to close the forum down.

I wonder, though, whether that actually solves the problem. Closing the forum prevents future litigation, but does it prevent the troll from continuing just the same? After all, he still has the right to get that information and, I suppose, the forum admin could still be fined for abuse of personal data during those 30 days or so during which the forum operated under GDPR, no? (Though chances of actually being fined probably decreases further, as damage has been minimized).


[this is not legal advice, it is my opinion]

This sentiment really bugs me and feeds into the irrational fear here (GDPRanoia). There are lots of laws that can be “theoretically” enforced that can ruin a business. There is tons of arm-chair theorizing going on here on what could happen.

In particular it bugs me cause historically EU privacy regulators never ever imposed a fine on a hobbyist and the fines usually went to Apple and Google and so on. There are numbers online about this and you can dig it up. This assumption that a forum operator acting in good faith is subject to financial ruin really annoys me.

If as a forum operator, you tell people how to download data, you anonymize on request, delete personal data on request (eg: bob uploaded a photo of himself and wants it removed) … just do the basics. Do not sell your user IP addresses and profile info and emails to the highest bidder etc and do horrendous stuff. I am pretty sure you will be ok.

Heck, if Google wants to shut down any business they can do it today. It is trivial. Get a lawyers to dig through the army of patents they have and then sue sue sue. They don’t even need to be right, they just have to cause so many legal fees that you can not afford to pay and then… bang you are bankrupt before the thing goes to trial. So… never ever start a business?

It offends me that people think that a body that is there “to protect our rights and privacy” is motivated by “shutting down every small operator out there that has one IP address stored in the database”.


I’m not sure whether that was meant as a critique of what I said but just to be clear: I also think that there is a lot of paranoia going on (and to an extent it is even useful in that it gets people to be more aware of the fact that they’re handling people’s data). My point with the part you quoted was not to say that the guy should be even more paranoid. I was just continuing his line of thought and wondering whether his actions (shutting down the forum) even make sense from a paranoid perspective.

You have to admit, though, that one big novelty of the GDPR is to make it easier to impose fines.


Yeah. It was an interesting point. Shutting down the forum doesn’t tell him what data you have or provide it to him as the GDPR requires.

Article 17. establishes the right to erasure. I can’t delete a user if she has posts. But by default posts can’t be deleted if they are older than 60 days: can I raise this as much as I need in settings?

“Users can’t be deleted if they have posts. Delete all posts before trying to delete a user. (Posts older than 60 days old can’t be deleted.)”

Why ask this question when you can try it yourself and see?

1 Like