Seeking moderator-specific GDPR guidance

[riking (Kane York)]

I am not a lawyer, and I am not licensed to practice law in your jurisdiction. This post contains my personal layman’s interpretation of the laws based on my own experience and knowledge. I am not going to warrant that this information is correct enough to create a legal obligatoin; if you need that assurance level, pay someone to give you advice (aka the job description of a lawyer).

It would be helpful to ensure all Admins/forum owners tell their Moderators about the GDPR legislation, and link them to specific guidelines when someone requests post deletion or when a “close my account and take all my stuff off” PM occurs.

Many forums have volunteer mods who are not going to be aware of the changes described, and they will probably be the first point of contact in most cases.

Correct - in my view, 90% of GDPR compliance is writing things down: such as your procedures of what to do when receiving such a request.

This will also logically be available to people who have been permanently suspended, even for serious abuses, as forum rules do not trump EU law.

You can keep around minimal records to prevent them from ban-evading / creating new accounts, as that is an overriding legitimate interest [over their right to privacy].

and also any posts or PMs made

Posts are not inherently personal data, and must be considered on a case-by-case basis. Tell the requester that either they must identify specific posts with personal information to be removed or pay you to do the search. (Or live with the idea that there might be trace identifiers on the forum, which were going to exist anyways.)

However, as noted above, where the request is manifestly unfounded or excessive you may charge a “reasonable fee” for the administrative costs of complying with the request.

Once the posts have been identified, edit them to remove the personal information and purge the revisions.

[… several different forms of administrative records …]

Those are not public records and have an overriding legitimate interest of keeping a complete and accurate log of moderator activity & posts that other people, who have not requested anonymization, made. The user ID references on flags will be stripped of their name. Post excerpts are not necessarily subject to deletion (see above; posts are licensed CC-BY-SA with the amendment that the author has requested that attribution be removed).
IPs get deleted when you anonymize a user.

Example 1 would be UserA gets into an argument where they become very abusive in the heat of the moment.

A moderator issues a warning to UserA and logs the incident in Staff as an aide-mémoire in case of future problems with that same person. Relying on memory means one person’s past misbehaviour may be recalled, another’s forgotten, resulting in uneven treatment; therefore, I log as much as possible, this has usually been regarded as best practice, and also promotes transparency and accountability.

2 weeks later UserA sends an “I am sick of this forum remove all my posts and erase my account, the EU says I can get this” PM to a mod/admin.

You can’t erase memories. The fact that the official warning is no longer tied in the database to the natural person’s chosen alias is enough.

Example 2 would be a UserB, a troll highly motivated by fanatical ideology of some kind who, after their suspension, makes the same request that all their data be completely erased to the forum’s owners, because they maliciously intend to delete anything that may identify them next time round, and also, inconvenience admins and moderators.

Would these necessitate removing all the material in the bulleted list above from the forum?

You can keep minimal records about the person that requested deletion to ensure you don’t collect more records in the future about them.

In this case, I would recommend placing their IP address on a list of “If you ever see an account get created from this IP, delete their account immediately as requested.”

relevant to Article 9.

Processing of personal data revealing … political opinions

I see that you d the post I made about this:

GDPR countdown and compliance

Processing of this data is allowed under Article 9(2) condition (e) - the data is made public by you posting it.