How to act on Abuse and GDPR


#1

The case of a reported member, who deleted their profile and created a new one later, made us think about how GDPR Data Removal Requests could interfere with safety on Trustroots.

As @guaka summed up, our duty to remember should override the right to be forgotten in these cases.

So, the privacy policy should allow

  • to read the messages in case of a report
  • to keep the user’s data in case of abuse/harassment (even with an interfering GDPR request)
  • as well as to share this data with other hospex networks in case of abuse/harassment

#2

Relates to https://github.com/Trustroots/trustroots/issues/237

Some questions:

  • how do we update our privacy policy? https://www.trustroots.org/privacy
  • can we get someone with a legal educational background to help us with this?
  • how do BeWelcome and Warmshowers handle this?

#3

There is a similar discussion in BW. In the BW terms of use is written:
“In case of a cancellation as a result of serious abuse, BeWelcome reserves the right to store information for an indefinite time to prevent the abuser from creating a new account.”
So that means only in case of SERIOUS abuse data will be stored forever.
Let’s say somebody has 3 negative comments, but no serious abuse was involved, the person can easily delete the profile and make a new profile later again. That is part of GDPR, people have the right to request deletion of all data.


#4

Do you think it would be possible to keep comments/references and attach them to a MD5 hash of the registration email? So TR could delete the email (and profile data) and keep the comments.
If the user registers again with the same email it would be possible to revive the comments because MD5 will match. I know it’s complex, but GDPR is… and TR could implement this taking its own time.

I suppose comments shouldn’t be considered part of the user’s personal data, they’re someone else’s data. But it would be interesting to hear a lawyer’s opinion about this!


#5

I’m not a lawyer, but I would say it’s not possible. If I have the right to request that all data about me is deleted than also comments should be deleted.
Let’s imagine I delete my profile and I request that all my data will be deleted as well. I won’t create a new profile. So even 10 years later TR would have some negative comments about me saved. For me a clear breach of GDPR.

In BW Terms of Use is written:
“For safety reasons and as required by the French authorities, removed data and content may be kept for up to twelve months. However, once you remove your data and content, it will no longer be visible. In case of a cancellation as a result of serious abuse, BeWelcome reserves the right to store information for an indefinite time to prevent the abuser from creating a new account.”

That was made before GDPR and the 12 months are due to French legislation, but maybe we could have something similar, keep the data for 12 months… (but not longer) and only in case of serious abuse keep it forever…


#6

I just thought about it and wondered.
How do you have to handle GDPR? would it be enough to completely “anonymize” the data so that it can not be linked to a person. Like is it enough to replace the “memberX-email” address with “gdpr-req%06d” and then, if requested, say: no, we do not have any data to “memberX-email” adress?
Also, if people on Trustrotos never actually register with full name and address, how would we be able to declare a GDPR-Request as authentic? What kind of min. validation is requested by GDPR?


#7

You could still have identifying info within the body of the text. To some (large) degree text in itself is identifying.