Request for data deletion, per the laws of a particular US state

[Wildcat Media]

We had a request come in last week that was quite strict in its demands. This member asked years ago that we delete their account. We typically will anonymize the account by changing the username, clearing out their profile data, and deactivating it. We would temporarily ban an account before anonymizing it, but in this case we overlooked it. Not a big deal, as we typically would complete the job and go on our way. This member participated many years ago, and didn't post a large amount.

But this person's request...

They're requesting all posts be deleted, as well as all the quotes of their posts in replies. Seriously? One part of the message claims they should not "self service" their request by asking them to provide links to all of their posts...yet we're supposed to place an undue burden upon ourselves to do this? This was among other demands regarding their activity on the forum, and demanding how we are to proceed and follow up with them. Not happening!

This state law gives us 45 days to respond, so we're taking our time. In the meantime, we're anonymizing the account and will run a query to change the quote attributions.

In addition, I've also suspected that this could be harassment--this person provides us with no real name, and no identification as to whether or not they reside in the state whose laws they are claiming to be protected under. I proposed that we request a picture of their photo ID, and other proof of residence, before we comply. In addition to showing us exactly where, in the state laws, it says that we need to be removing content. I've read through that law; there's nothing in there about it. This person didn't even sign the email with anything but their forum user ID, not a real name.

Not only that, reading more into the law and based on the state's own web site, the law doesn't even apply to us anyway.



(State is redacted in case that person is trolling this forum.) Nobody really defines what "processing" means in this context. The forum has under 150,000 members, but many are dead accounts. As for "processing," I would tend to think that this refers to members signing up to a forum per year which, after 23 years, would amount to only a small fraction of our total membership. Certainly, accounts sitting dormant are not being "processed" in any way. The second portion of course does not apply, as we do not sell personal data. On that point alone, I would consider blowing this person off (in other words, we anonymize the account, and we're done). "Commercial products or services" also does not apply to us. We run on donations; we don't sell anything for a fee or price.

Again, we anonymize as a courtesy. Even our forum policies state that we do not delete posts on demand. I kind of doubt that the many privacy policies around the world request content removal (as long as it doesn't contain personal information, for obvious reasons).

Anyway, all of the above is just me, venting. We've already decided what to do.

---

What's bothering me the most here is that this person's message reads like boilerplate, almost like a privacy company provided it like a form letter for this person to fill out. It comes out sounding legal, yet even the section of the law they claim exists in this state isn't even properly referenced! I eventually found a reference to this person's nonsense on the law.justia.com site, where this disclaimer is posted:



I did try a Google search using some of the phrases in the email to see if it came up as boilerplate, but I found nothing so far. I'm not spending much more time on this, however. This type of email was structured in a way to sound legal, and vaguely like a threat. It's not something our typical member would compose on their own, in other words. I've never used any privacy services (although I'm about to...I'm tired of the intrusions), but if anyone has seen anything similar, it would be interesting to hear about it.

And also, if you've actually read the law to see what applies, have you blown off similar requests if the law does not apply to your situation? As I pointed out above, per the state's own web site, the law only applies to certain entities, and we could not be categorized under any of them. We'll still honor a removal request anyway (by anonymizing/clearing out an account) if asked nicely, but removal of content is completely out of the picture unless they've posted personal information within that content.

 

[digitalpoint]

The California Consumer Privacy Act's "right to delete" only applies to personally identifiable information (which normally isn't going to be the content of posts themselves unless the user is posting info about themselves).

California Consumer Privacy Act (CCPA)

Updated on March 13, 2024 The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law.

oag.ca.gov

You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information).

Even a username isn't considered PII unless it can be somehow linked to a specific individual.

What is considered PII:

Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics.

...again, content of posts and even usernames are normally not PII.

As you pointed out, CCPA doesn't even apply to you unless you have gross annual revenue over $25M or you specifically buying/selling personal information of more than 100,000 California residents.

Additionally, even if you fell into the bucket of needing to comply with CCPA, as you also pointed out, you don't even know if they are a resident of California. You have the right to verify the identity of the person making the request.

Businesses must verify that the person making a request to know is the consumer about whom the business has personal information. Businesses may need to ask you for additional information for verification purposes. If the business asks for personal information to verify your identity, it can only use that information for this verification purpose.

But again... unless you are generating more than $25M/year, it's all moot anyway.

Personally, I'd ignore the request.

 

[zappaDPJ]

I'm more familiar with EU/UK privacy laws but I agree with @digitalpoint. In the EU/UK usernames are generally considered to be PII but that's the only real difference I'm aware of.

One observation going forward; I make a point of informing any member making such a request that once the account has been anonymised no further communication can be entered into. The primary reason is that assuming you have removed the relevant PII you should have no way of verifying it's the same member.

Also in the unlikelihood that there is PII contained within the member's content I insist that they identify it to me prior to anonymising the account.

 

[Wildcat Media]

The California Consumer Privacy Act's "right to delete" only applies to personally identifiable information (which normally isn't going to be the content of posts themselves unless the user is posting info about themselves).

It may not be California , but the law is very similar. I left it vague only in case this person is trolling around the XF support forums.

The one thing I considered just now is that if a person uses their real name as their username, that could qualify as being personally identifiable. There are a very small number of forums out there which require members to use their real names. But other than that, some members are oblivious to it and use real names.

One observation going forward; I make a point of informing any member making such a request that once the account has been anonymised no further communication can be entered into. The primary reason is that assuming you have removed the relevant PII you should have no way of verifying it's the same member.

That's a good point. And yeah, we may very well ignore it. The staffer handling it says that he is going to sit on it for a while.


My main point of the post, though, was how it was presented to us, like it was a form letter. It makes me think this person might be using a privacy service, provided with a prepared email that the person only needs to paste into their email and send to anyone they want. I'm curious to know if anyone else has used a similar security service and if this is the type of BS that it spews out.

I also wouldn't put it past some AI service to compose something like this. (I can't post it publicly because, again, that person could troll this forum to see if we're talking about it.)