Re: Proposed New Rules: Discussion and Feedback
The forum does have to comply with the GDPR. A data controller is "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law". It classifies a data processor as "a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller". Finally, it classifies personal data as "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person". However, while this seems clear-cut, there are three issues with this idea that readers of this post probably have of the AG.NET forum being a data controller/data processor processing personal data:
* All of the personal data can be erased or not entered at any time by the data subject: you don't need to specify anything in your profile that uniquely identifies you.
* Your online identifier (in this case, your username) can be changed at any time via a request to the moderators/administrators. As such, the online identifier is dynamic and, therefore, can make identifying (directly or indirectly) the data subject difficult just by modifying this online identifier.
* The data subject can delete their account at any time via a request to the moderators/administrators.
The GDPR also classifies "processing" as meaning "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".
So, in summary:
* The AG.NET forum is a data processor only. It is not a data controller; the data controller is the data subject.
* The AG.NET forum is capable (and does) process a very limited range of personal data. The AG.NET forum does not, however, collect any private personal data.
* The data subject is in full control of the processing and storage of their personal data. The data subject is capable of collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making available, aligning or combining, restricting, erasing or destroying of the personal data the forum does collect, either by editing their profile or by contacting the administrators or moderators for wide-scale tasks (deleting their account, altering their online identifier, and so on).
But I digress. The hole point of this little diatribe was to prove that TGC's actions were (entirely) unwarranted. As he is the data subject and data controller, he is capable of controlling the data that the forum does process. He, however, is only capable of controlling his personal data and not any others.
Anyway! I do have to agree with 166 and 167. Users should be allowed to delete their account, but not delete *every single* post they've made via automated means. Hell, the task alone would be incredibly hard. It would, also, leave gaps and spark confusion on the forum, and would be a way of causing chaos because people would be seeing replies that (seemingly) reply to someone who does not exist. And that could then be used to call them out for supposed 'character assassination', which, at that point, would definitely have a lot of evidence for, and it would be an extremely powerful way for people to destroy the credibility and reputation of others. Let's take myself as an example. If I suddenly went through and deleted all... oh... 3000 plus posts of mine, I could then call pretty much half the members of this forum out for character assassination -- and it would look that way too! It wouldn't be, of course, but forum-wide deletion of an accounts posts could cause a ridiculously large amount of damage that would be impractical to recover from. You could look things up via archive.org or via google cached pages, of course, but most people probably wouldn't.
And no, I'm not going to do that. I'm not that evil.
Disclaimer: the above scenario was meant for demonstrative purpose of only on how the forum-wide deletion of an accounts posts could harm other members of he forum. No harm to other forum members should not have been caused by the recording of said scenario.
-- Audiogames-reflector mailing list Audiogames-reflector@sabahattin-gucukoglu.com https://sabahattin-gucukoglu.com/cgi-bin/mailman/listinfo/audiogames-reflector
