GDPR - first ever request

J

JamesAus

Active member
Hi All, one of my members who has recently been banned for 7 days seems to want to cause time-wasting and problems for our site, and sent this email:

Subject access request

In accordance with Article 15 of the General Data Protection Regulation (GDPR) of the European Union, by which XXXXXXX is bound, I am hereby making a data subject access request in respect of the personal data you (i.e. XXXXXXXXX) hold in relation to me.

Please supply the personal data you hold about me, which I am entitled to receive under data protection law.

In particular, I am interested in receiving personal data relating to:

  • Posts made about me in the moderators forum (made between August 2006 and August 2020)
  • Emails between moderators in which I am discussed (between August 2006 and August 2020)
  • Emails sent to me by any members of the moderation team (between August 2006 and August 2020)
  • Any information pertaining to my location (e.g. IP addresses)
  • Any marketing tracking or behaviour data (e.g. click rate, website user behaviour, browser user agent, user preferences, inferred user behaviour etc.)
  • How many infraction points I currently hold.
If you need any more information, please let me know as soon as possible.

I would prefer to receive the data in MS Word/PDF format.

It may be helpful for you to know that GDPR requires you to respond to a request for personal data within one calendar month.

If you do not normally deal with these requests, you may wish to consult a solicitor or other data protection professional.

If you need advice on dealing with this request, the Information Commissioner’s Office can assist you. Its website is ico.org.uk, or it can be contacted on 0303 123 1113
Click to expand...
We're a small fan site and can't afford to engage any legal assistance so I hoped the forum community here would be able to offer some advice.

In relation to the points:

  • Posts made about me in the moderators forum (made between August 2006 and August 2020
Click to expand...
We were using vBulletin up until recently and when a reported post was made, it automatically created a thread in the subforum that we would sometimes merge into a thread about the member if they were problematic. This member was and the mod team would discuss what approach to take.

  • Emails between moderators in which I am discussed (between August 2006 and August 2020
  • Emails sent to me by any members of the moderation team (between August 2006 and August 2020)
Click to expand...
Moderators are volunteers and other members on the site - would have thought what they do in their own personal email addresses is outside what is a reasonable request of my site?

Any information pertaining to my location (e.g. IP addresse
Click to expand...
I believe I can get this from default XenForo contracts.

  • Any marketing tracking or behaviour data (e.g. click rate, website user behaviour, browser user agent, user preferences, inferred user behaviour etc.)
Click to expand...
I use Google Analytics. Assume I can then pass him to Google?

  • How many infraction points I currently hold.
Click to expand...
How is this personal data?
 
Sort by date Sort by votes
I've put together this draft email to the ICO if anyone has any further thoughts.

Hi XXXX @ ICO,

Thanks for coming back to me with further details.

Regarding the points we didn't respond to. As this member of our fan-site is a regular troublemaker we didn't entertain far-reaching requests which we considered these as.

We plan on responding as follows. Is that acceptable to the ICO?

****
Hi XXXXXXXX Member,

We've been asked to respond to the points about you in further detail.

>Posts made about me in the moderators forum (made between August 2006 and August 2020
Click to expand...

This is exempt from disclosure as doing so would provide a third parties information (without their consent [other members reported posts and moderators]) that they would have expected to be kept private.

We make reference to the following:
https://ico.org.uk/for-organisation...f-access/information-about-other-individuals/

>>Emails between moderators in which I am discussed (between August 2006 and August 2020

As above.

>>Emails sent to me by any members of the moderation team (between August 2006 and August 2020)

This is impossible for us to do, as emails are only kept for a period of 3 months and are sent through our official email address of XXXXX. Please let me know if you'd like any sent through to you during this period.

>>Any marketing tracking or behaviour data (e.g. click rate, website user behaviour, browser user agent, user preferences, inferred user behaviour etc.)

We use the Google Analytics platform. To lookup and provide you with the information held, please provide us with your Google Analytics ClientID. To find this, you'll need to go to your browser’s settings and manually look at what cookies there. You should find one named _ga, which is the Google Analytics cookie, and within it is a string like GA1.2-2.318596131.1556642125.

Your ClientID are the numbers before and after the final period (in this case, 318596131.1556642125). If you have multiple _ga cookies on their browser, please send all of the ClientIDs.

>>How many infraction points I currently hold.

Your account has been deleted and all traces of personal information have been removed from our database, so this is not something we are able to provide anymore. Please note that we no longer consider you welcome on the XXXXX Forums.

****
Click to expand...
 
Upvote 0 Downvote
First things first before you do anything else - Permanently Ban him !

No reason, nor excuse - it's your site, he wouldn't be welcome in your home - get rid

He is not part of your community, he is there to cause trouble within it and for you

(I'll read the rest of the posts later)
 
Upvote 1 Downvote
webbouk said:
First things first before you do anything else - Permanently Ban him !

No reason, nor excuse - it's your site, he wouldn't be welcome in your home - get rid

He is not part of your community, he is there to cause trouble within it and for you

(I'll read the rest of the posts later)
Click to expand...

I'm holding off for the moment, just from the point of view of not antagonizing him until the ICO reply and I know where I stand. He's apparently from what I've heard from a 3rd party - "He could argue the deletion of his data was unlawful in the European Union. That would be a whole other thing. It wouldn't just end with the deletion. He would not have a great case but you'd still be peppered by it. " . I'm planning to reach out to this member and have a chat with him and try and resolve this in a friendly way. Perhaps I'm being stupid, but if something can be worked out in a friendly way, I'm up for trying just so the whole thing can go-away.

I've sent the draft email to the ICO so I'll let everyone know what I get back.

webbouk said:
"Please note that we no longer consider you welcome on the XXXXX Forums"

Leave this out of any communication as you are inviting more questions and problems
Click to expand...

Thanks for the suggestion.
 
Upvote 0 Downvote
I'm sorry to disagree with you:

I'm planning to reach out to this member and have a chat with him and try and resolve this in a friendly way - will not happen, this time or the future

I'm being stupid - respectfully - yes

but if something can be worked out in a friendly way, I'm up for trying just so the whole thing can go-away. - it will never go away as he's already done the dirty on you and it will happen again, or he'll brag to his online mates and get them to do the same


There comes a time when you have to be hard, act hard, go in hard - you'll thank yourself for it later.
 
Upvote 1 Downvote
webbouk said:
I'm sorry to disagree with you:

I'm planning to reach out to this member and have a chat with him and try and resolve this in a friendly way - will not happen, this time or the future

I'm being stupid - respectfully - yes

but if something can be worked out in a friendly way, I'm up for trying just so the whole thing can go-away. - it will never go away as he's already done the dirty on you and it will happen again, or he'll brag to his online mates and get them to do the same


There comes a time when you have to be hard, act hard, go in hard - you'll thank yourself for it later.
Click to expand...

I don't disagree with anything you have said. I'm just nervous about whether there are any gotchas lurking that he could exploit. My site is a simple fan-site with a fairly small community, and I can really do without the headaches if he wants to take this any further. I don't have the $ or the time to engage lawyers, etc.
 
Upvote 0 Downvote
And I suspect if it was to cost him anything he wouldn't pursue it either - he's a troublemaker, and bullying you, he's doing this because he can - look at it as him vs the moderating team, as long as he's a member he's sticking two fingers up at them and you and laughing about it.
 
Upvote 1 Downvote
Fwiw, the idea of "going hard" almost never works out. You just create a person with an agenda and even sometimes hell bent on causing you headaches. I think keeping a level head, staying unprovoked, is the wiser choice.
 
Upvote 0 Downvote
Mike Creuzer said:
Fwiw, the idea of "going hard" almost never works out. You just create a person with an agenda and even sometimes hell bent on causing you headaches. I think keeping a level head, staying unprovoked, is the wiser choice.
Click to expand...
Yes, that's my line of thinking too. See what the ICO has to say, but attempt to engage with the member and work out a common-sense middle-ground.

I appreciate where @webbouk is coming from though, and can certainly see his point of view.
 
Upvote 0 Downvote
JamesAus said:
common-sense middle-ground.
Click to expand...
...left the field of play when he involved the ICO

Did he attempt to engage with the moderators/yourself and work out a common-sense middle-ground relating to his ban and membership issues?
Somehow I doubt it.

Once you engage with him, bearing in mind the point you are now at, you've lost the upper hand and he'll take it as carte blanche that he is in control, which to be fair it sounds like he is.

Anyway, I'll bid you good luck, I've offered my advices, the ball (or what's left of it) is in your court <no puns intended>
 
Upvote 0 Downvote
webbouk said:
...left the field of play when he involved the ICO

Did he attempt to engage with the moderators/yourself and work out a common-sense middle-ground relating to his ban and membership issues?
Somehow I doubt it.

Once you engage with him, bearing in mind the point you are now at, you've lost the upper hand and he'll take it as carte blanche that he is in control, which to be fair it sounds like he is.

Anyway, I'll bid you good luck, I've offered my advices, the ball (or what's left of it) is in your court <no puns intended>
Click to expand...

Don't get me wrong webbouk. I honestly really appreciate your take on the situation and as I said, I may well be left looking the fool but it's something I think is worth trying.

I can't fault your logic and everything you said there is correct. I'll keep posting updates in this thread to hopefully gain opinions from helpful people like yourself.
 
Upvote 0 Downvote
JamesAus said:
He could argue the deletion of his data was unlawful in the European Union
Click to expand...

On what basis? It is your site, what you decide to do with the data created on it is entirely up to you. Could you imagine if when site owners close their sites down the members could sue them for "loss of data"? It would be absurd.

Honestly I would just comply with the ICO as cleanly as possible then delete him.
 
Upvote 1 Downvote
Have coded a bundle module for vBulletin 4, which includes better EU Cookies policy and complete GDPR functions. I'm not familiar with XF coding and my age does not permits me to spend time learning something new. But if any XF coder wish to port it for XF, I'm willing to give him full rights to modify my code, without to ask even a single cent. It's up to him to release it for Free or Paid mod, I don't care.

1606825201874.png

1606825861833.webp

1606825257615.png

As you can see a user can download in PDF format, all his data and all his post history.

- Chris

PS: Design is responsive.
 
Last edited:
Upvote 0 Downvote
ChrisTERiS said:
Have coded a bundle module for vBulletin 4, which includes better EU Cookies policy and complete GDPR functions. I'm not familiar with XF coding and my age does not permits me to spend time learning something new. But if any XF coder wish to port it for XF, I'm willing to give him full rights to modify my code, without to ask even a single cent. It's up to him to release it for Free or Paid mod, I don't care.

View attachment 240990

View attachment 240992

View attachment 240991

As you can see a user can download in PDF format, all his data and all his post history.

- Chris

PS: Design is responsive.
Click to expand...
This is what we need! This'd solve so many problems for people that have to deal with those GDPR requests!
This could be a great next addon @AndrewSimm hint! 👀
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

Mr. Jinx
GDPR user request regarding private converstation
Replies
3
Views
440
Mr Lucky
Mr Lucky
Stuart Wright
  • Question Question
XF 2.1 GDPR SAR subject access request queries
2 3
Replies
51
Views
5K
Chris D
Chris D
H
Removing trolls personal details with a GDPR request
Replies
3
Views
556
Sperber
S
xpl0iter
Creating my first ever addon
Replies
13
Views
1K
Chris D
Chris D
TheBigK
  • Question Question
XF 1.1 Display Ads After First & Every Fifth Post On All Pages In Thread
Replies
3
Views
779
TheBigK
TheBigK
Top Bottom