Batch Update Users: Does 'Delete' Rename Users?

[Matthew H]

Does batch deleting users rename them, or do their names simply not exist anymore?

 

[Jeremy P]

It does not rename the users. Messages will retain the username but it will not be attached to an account. A new account can be registered with the same name.

 

[Matthew H]

So, I can use it to prune inactive users who have a zero post count and still be GDPR compliant.

 

[Alvin63]

I may have a problem with this. Having batch deleted all users, when I closed the site down. I then later re-opened it. While some people have rejoined, I now have peoples former usernames all over the site, who aren't members any more. Now although none of them requested to be deleted, just wondering if this is a GDPR issue, that I have usernames still public of ex members? Or would it only be if they contacted me and said they wanted it removing (and it could be difficult to remove a username from a closed account - presumably they'd need to rejoin with the same name - reattach their name to their posts, then delete again removing the username?)

 

[chillibear]

You can't (easily) re-attach orphaned posts to a new user. So in the database the user_id associated with the posts is set to 0. The username 'cache' (if you like) attached to each post remains (or you can when deleting users optionally set it to something else). You'd have to have a script that looked for usernames and reset the user_id value on those posts. Obviously milage may vary depending on how much time/churn had passed. In your case I expect it could be done.

 

[Mr Lucky]

I wouldn't worry for GDPR as the (guest) username is attached to personal details. If it shows with some content, e.g. post, that contains personal details then it would be up to them to request deletion. It would be difficult to prove the person requesting is the same person as the deleted account, as you would no longer have any evidence connecting them such as email or IP.

e.g.

• You delete user John Smith
• A person called John Smith contacts you and says you must delete the post where John Smith posted his phone number, address, date of birth, SS number and hat size.
• How do you know it is the same John Smith?

 

[Alvin63]

Thanks @chillibear I have reattached old accounts to users before (AndyB has an addon) but that's for people who come back to the site. Not people who aren't registered any more. And it would be rather a lot of accounts to deal with anyway.

I wouldn't worry for GDPR as the (guest) username is attached to personal details. If it shows with some content, e.g. post, that contains personal details then it would be up to them to request deletion. It would be difficult to prove the person requesting is the same person as the deleted account, as you would no longer have any evidence connecting them such as email or IP.

e.g.

• You delete user John Smith
• A person called John Smith contacts you and says you must delete the post where John Smith posted his phone number, address, date of birth, SS number and hat size.
• How do you know it is the same John Smith?

Thanks. That makes sense - unless someone has used their real name as their username maybe? Identifying info. I guess if that happened (ie someone complained) then I'd just reactivate it with a new account and delete it. Technically as well, no details are actually stored. Although I guess someone could argue their name must be stored if it appears on an old account. Or is it more like a screenshot of an old account?

 

[chillibear]

Yes sorry re-reading I realised you were asking about removing further data. GDPR wise the normal T&C with XF grants you the rights to publish posts (in the context of the board) - so technically you're dealing with your copy so "tough" as far as wholesale removal goes. Now that said if you've got a post that is very obviously containing some kind of personal information and someone asks to remove it we generally do (or we edit the post in preference). If it's nor really super sensitive then we wouldn't generally bother. We always make it very clear to users when they ask to be deleted that their posts will remain and will have their username attached to them (unless they ask otherwise), but will be orphaned.

As far as usernames go that does seem to have caused some debate here over the years about "personal data". Putting to one side the extra faff of quotes and even just mentions of a user in other posts just changing the username attached to a post isn't super difficult. From time to time we've had requests much much later after an account deletion to remove usernames (generally the person in touch is claiming a stalker/domestic violence reason). In those cases I've just updated the database directly to change the username since it didn't seem like it'd cause any harm (Bob123 is now Dave456, etc) and I figured if they'd bothered to get in touch specifically then they probably were who they said they were.

 

[Alvin63]

Thank you.