Request for data deletion, per the laws of a particular US state

[Wildcat Media]

We had a request come in last week that was quite strict in its demands. This member asked years ago that we delete their account. We typically will anonymize the account by changing the username, clearing out their profile data, and deactivating it. We would temporarily ban an account before anonymizing it, but in this case we overlooked it. Not a big deal, as we typically would complete the job and go on our way. This member participated many years ago, and didn't post a large amount.

But this person's request...

They're requesting all posts be deleted, as well as all the quotes of their posts in replies. Seriously? One part of the message claims they should not "self service" their request by asking them to provide links to all of their posts...yet we're supposed to place an undue burden upon ourselves to do this? This was among other demands regarding their activity on the forum, and demanding how we are to proceed and follow up with them. Not happening!

This state law gives us 45 days to respond, so we're taking our time. In the meantime, we're anonymizing the account and will run a query to change the quote attributions.

In addition, I've also suspected that this could be harassment--this person provides us with no real name, and no identification as to whether or not they reside in the state whose laws they are claiming to be protected under. I proposed that we request a picture of their photo ID, and other proof of residence, before we comply. In addition to showing us exactly where, in the state laws, it says that we need to be removing content. I've read through that law; there's nothing in there about it. This person didn't even sign the email with anything but their forum user ID, not a real name.

Not only that, reading more into the law and based on the state's own web site, the law doesn't even apply to us anyway.



(State is redacted in case that person is trolling this forum.) Nobody really defines what "processing" means in this context. The forum has under 150,000 members, but many are dead accounts. As for "processing," I would tend to think that this refers to members signing up to a forum per year which, after 23 years, would amount to only a small fraction of our total membership. Certainly, accounts sitting dormant are not being "processed" in any way. The second portion of course does not apply, as we do not sell personal data. On that point alone, I would consider blowing this person off (in other words, we anonymize the account, and we're done). "Commercial products or services" also does not apply to us. We run on donations; we don't sell anything for a fee or price.

Again, we anonymize as a courtesy. Even our forum policies state that we do not delete posts on demand. I kind of doubt that the many privacy policies around the world request content removal (as long as it doesn't contain personal information, for obvious reasons).

Anyway, all of the above is just me, venting. We've already decided what to do.

---

What's bothering me the most here is that this person's message reads like boilerplate, almost like a privacy company provided it like a form letter for this person to fill out. It comes out sounding legal, yet even the section of the law they claim exists in this state isn't even properly referenced! I eventually found a reference to this person's nonsense on the law.justia.com site, where this disclaimer is posted:



I did try a Google search using some of the phrases in the email to see if it came up as boilerplate, but I found nothing so far. I'm not spending much more time on this, however. This type of email was structured in a way to sound legal, and vaguely like a threat. It's not something our typical member would compose on their own, in other words. I've never used any privacy services (although I'm about to...I'm tired of the intrusions), but if anyone has seen anything similar, it would be interesting to hear about it.

And also, if you've actually read the law to see what applies, have you blown off similar requests if the law does not apply to your situation? As I pointed out above, per the state's own web site, the law only applies to certain entities, and we could not be categorized under any of them. We'll still honor a removal request anyway (by anonymizing/clearing out an account) if asked nicely, but removal of content is completely out of the picture unless they've posted personal information within that content.

 

[digitalpoint]

The California Consumer Privacy Act's "right to delete" only applies to personally identifiable information (which normally isn't going to be the content of posts themselves unless the user is posting info about themselves).

California Consumer Privacy Act (CCPA)

Updated on March 13, 2024 The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law.

oag.ca.gov

You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information).

Even a username isn't considered PII unless it can be somehow linked to a specific individual.

What is considered PII:

Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics.

...again, content of posts and even usernames are normally not PII.

As you pointed out, CCPA doesn't even apply to you unless you have gross annual revenue over $25M or you specifically buying/selling personal information of more than 100,000 California residents.

Additionally, even if you fell into the bucket of needing to comply with CCPA, as you also pointed out, you don't even know if they are a resident of California. You have the right to verify the identity of the person making the request.

Businesses must verify that the person making a request to know is the consumer about whom the business has personal information. Businesses may need to ask you for additional information for verification purposes. If the business asks for personal information to verify your identity, it can only use that information for this verification purpose.

But again... unless you are generating more than $25M/year, it's all moot anyway.

Personally, I'd ignore the request.

 

[zappaDPJ]

I'm more familiar with EU/UK privacy laws but I agree with @digitalpoint. In the EU/UK usernames are generally considered to be PII but that's the only real difference I'm aware of.

One observation going forward; I make a point of informing any member making such a request that once the account has been anonymised no further communication can be entered into. The primary reason is that assuming you have removed the relevant PII you should have no way of verifying it's the same member.

Also in the unlikelihood that there is PII contained within the member's content I insist that they identify it to me prior to anonymising the account.