Apply Name Change to quotes & user mentions (GDPR)

[Alpha1]

The EU GDPR forces a right to be forgotten which means that we need to be able to remove the name of person from our site. Currently this is not fully possible, except manually. Because user mentions and quotes still include the name. For big boards its not feasible to manually edit all posts. I have 2 million posts on my site and just 2 admins.

For example: at the current time I have 5600 posts here on XF.com If I would request a name change, then there's probably around 1k quotes and tags with my name in it. Its not feasible to manually edit that.

So please add a function that scans the database for quotes and user mentions for the user and replaces the name of the user.

 

[dutchbb]

At the moment i am using this: https://xenforo.com/community/resources/post-content-find-replace.1549/

quick find: name
regular expression: /name/i
replacement string: other name

Works pretty good if it is an unique name and not a common word. But under right to be forgotten we are speaking of a persons real name or pointing to that persons real indentity. I do not remove made up forum names that point to nothing..

Also you still have to scan the complete posts because sometimes the name is mentioned outside a quote or without @. So it will be the same function as this add-on, but for big boards you have to manual edit a file and cap to like 5000 posts per search. So integrating someting like this without manual edits would be great.

But i think many mistakes could be made with a function like this, like with the add-on you could check first before applying but can still happen (same as bulk deleting threads or users or a forum with threads still in, so nothing new) . A plus point is that you can revert the changes made to the posts if a mistake is made (edit your profile and revert all posts edits within a set time, strangly enough you can't do that with super admin account so have to change that first).

An other non-permanent option is to censor the name (or change it to other) with the already build in function.

 

[Kirby]

Currently this is not fully possible, except manually.

Even manually it is not really possible in all cases:

What if a user choses the name "Weather Forecast", posts "Today is gonna be a nice warm day" in one thread and I post "[quote=Weater Forecast]Today is gonna be a nice day[/quote] That's great news :)"in another, apparently completely unrelated thread titled "How's the forecast for today?".

Did I quote him or did I not?

 

[dutchbb]

Even manually it is not really possible in all cases:

What if a user choses the name "Weather Forecast", posts "Today is gonna be a nice warm day" in one thread and I post "[quote=Weater Forecast]Today is gonna be a nice day[/quote] That's great news :)"in another, apparently completely unrelated thread titled "How's the forecast for today?".

Did I quote him or did I not?

You could search in (if possible):

[QUOTE="Weather Forecast, post: 1249205, member: 1059"]

Instead of the full quote or posts. But not something that is under right to be forgotten? If somebody's personal identity can't be linked to an account there is nothing to do. In some cases you can just remove some posted details if necessary.

 

[StarArmy]

Can't you just use a wordfilter (profanity filter) in most cases? I once had a company send a lawyer to bother me because a user chose the same name as their company trademark. The user had already been banned so I just renamed the user and then used a wordfilter to change his username mentions into something else.

 

[dutchbb]

For quotes i am doing it like this at the moment and works fine. Doesn't matter what the name is it only finds "name, what is used i quotes only. You could also add -> QUOTE="name, post: to be sure and add this in replacement string.

Quick Find: name

Regular expression: /"name,/i

Replacement String: "other name,

For mentions use @somename in regular expression and @othername to replace.

 

[trapped_soul]

For quotes i am doing it like this at the moment and works fine. Doesn't matter what the name is it only finds "name, what is used i quotes only. You could also add -> QUOTE="name, post: to be sure and add this in replacement string.

Quick Find: name

Regular expression: /"name,/i

Replacement String: "other name,

For mentions use @somename in regular expression and @othername to replace.

Thank you for this!

 

[Slavik]

So please add a function that scans the database for quotes and user mentions for the user and replaces the name of the user.

I would argue this falls out the scope of GDPR as once you post something in the public domain people can quote, screenshot, crawl, copy it etc.

 

[we_are_borg]

While the post is governed by the license of the website someone posts on the username is not. Meaning that the post should have a license that grants unlimited use on the site that can not be revoked. But the username is an identifying personal information even if its an allias so when someone want to be forgotten its for all names on a site so in this case attachment to a post and a quote. Here comes a real kicker and there is still discussion about this if you set it as for example guest101 that person has the new allias of guest101 so it can still be tracked because many know who wrote what. So this matter is not as simple as it seems.

 

[dutchbb]

If you rename and remove personal information in background (like e-mail) should be enough. If information in posts can't be tracked to the person there is no problem.

That many know who wrote it is something you can't change by removing the posts. New visitors will not know.

 

[we_are_borg]

GDPR does not care if some one is new or not it only cares about if some one can be traced back in this case. Here lies the problem old members know who he was so the right to be forgotten is not yet full filed. The only way you can full fill this is by making all deleted users guest, but some posts can be traced back to a user. So this is not something that can be solved asap but by making every deleted user guest ithink you should that you want to comply with the law.

 

[dutchbb]

If someone his information is removed there is nothing linking that person to the account. Nobody can find that person again in google and on your forum and can say for sure yes that is this person. I think the GDPR is ok with that and cannot say yes that is the same person and you must remove.. nothing because there is only text.

I would not worry about this and if so you will get a email from someone that handles GDPR in your country to remove it. But that is very unlikely.

 

[we_are_borg]

Under GDPR a name or username is personal information if some one requests to be forgotten its about the name and all other information like gender, email, icq etc etc. The person that requested it does not want his/here username or name on the site anymore. In qouted text the username still appears on the site and people that are on that site know who that person was so a new username or name is now the new allias.

Worry about it well instead of an email, call or letter they can send a fine straight away for not following the law, you can goto court but three things can happen. One you need to pay the fine, two fine is revoked or third you pay more or less.

 

[Slavik]

Under GDPR a name or username is personal information if some one requests to be forgotten its about the name and all other information like gender, email, icq etc etc. The person that requested it does not want his/here username or name on the site anymore. In qouted text the username still appears on the site and people that are on that site know who that person was so a new username or name is now the new allias.

Worry about it well instead of an email, call or letter they can send a fine straight away for not following the law, you can goto court but three things can happen. One you need to pay the fine, two fine is revoked or third you pay more or less.

And as ive been saying for months, the right to erasure is not an absolute right.

This whole "extending to quotes" debate is a bit of a farce to be honest as there are a magnitude of provisions in GDPR which basically mean that as far as XenForo is concerned, we already go BEYOND the required standards for erasure.

 

[dutchbb]

Under GDPR a name or username is personal information if some one requests to be forgotten its about the name and all other information like gender, email, icq etc etc. The person that requested it does not want his/here username or name on the site anymore. In qouted text the username still appears on the site and people that are on that site know who that person was so a new username or name is now the new allias.

Worry about it well instead of an email, call or letter they can send a fine straight away for not following the law, you can goto court but three things can happen. One you need to pay the fine, two fine is revoked or third you pay more or less.

That is why i also change the name in qoutes.. I change the name everywhere because it is safe and easy with the replace add-on. Also because you can follow the threads better if the name is changed everywhere.

I was responding to what you said earlier: "Here comes a real kicker and there is still discussion about this if you set it as for example guest101 that person has the new allias of guest101 so it can still be tracked because many know who wrote what. So this matter is not as simple as it seems. "

Not sure if you get a fine straight away, as i have read you get a warning first

 

[dutchbb]

And as ive been saying for months, the right to erasure is not an absolute right.

This whole "extending to quotes" debate is a bit of a farce to be honest as there are a magnitude of provisions in GDPR which basically mean that as far as XenForo is concerned, we already go BEYOND the required standards for erasure.

Correct, only in specific cases were the user can be tracked to his own name (real identity) or personal information. But you also have something like the right to publish information for the public, or something like that (like news). So a request to be forgotten is in some cases not valid.

And if quotes have to be changed there is also the question if that quote belongs to that person or the one that quoted him.

 

[Slavik]

Correct, only in specific cases were the user can be tracked to his own name (real identity) or personal information. If quotes have to be changed also is the question, because that quote is in someone else his post makes it not his to request to change?

While not so black and white, (but nearly) pretty much the moment you post anything publicly, you as good as forfeit the right of control over it.

If someone else quotes you, or screenshots you, or shares your content to social media, you have no ability to make that person take down the information. That is the risk you take when you make posts online, and GDPR does not extend to allowing you to expunge yourself off the internet.

 

[we_are_borg]

I was responding to what you said earlier: "Here comes a real kicker and there is still discussion about this if you set it as for example guest101 that person has the new allias of guest101 so it can still be tracked because many know who wrote what. So this matter is not as simple as it seems. "

Not sure if you get a fine straight away, as i have read you get a warning first

Well nothing in GDPR says they need to talk to you first for a fine, but AP (Dutch ICO) said they want to educate people first but if the breach is severe then they will fine. But the above as quote i would find it strange if they did not talk first, but that said GDPR does not take in account guest or username its all the same. We had this discussion few months back and other scripts adjusted there system all ready for this.

 

[we_are_borg]

While not so black and white, (but nearly) pretty much the moment you post anything publicly, you as good as forfeit the right of control over it.

If someone else quotes you, or screenshots you, or shares your content to social media, you have no ability to make that person take down the information. That is the risk you take when you make posts online, and GDPR does not extend to allowing you to expunge yourself off the internet.

That's why GDPR says the owner of the site is responsible not the one posting it. So if i want to be forgotten its to website owner that needs to act.

 

[Alpha1]

While not so black and white, (but nearly) pretty much the moment you post anything publicly, you as good as forfeit the right of control over it.

If someone else quotes you, or screenshots you, or shares your content to social media, you have no ability to make that person take down the information. That is the risk you take when you make posts online, and GDPR does not extend to allowing you to expunge yourself off the internet.

What is quoted is the users content. The users account name is copied when the quote is made. You can make the case that its also part of the quote, but I am not sure this argument would hold up or not.

It indirectly falls under the GDPR in another way: People will find their name in google and will file a 'right to be forgotten' to Google. Then the pages where the user is quoted are removed from Google's index. Which is an unwanted result.

And regardless of the GDPR it is a whole lot friendlier to users if after an account name change they do not find their name still on the site. People get quite upset about that.