Okay, after years of hearing this and that about GDPR, and reading this and that, and soaking up all kinds of opinions... Here is my GDPR guide for forums.
To-do:
- Put this in a Github repository and then you can submit a pull request to make it better
- Make the table of contents linked
GDPR Guidance
For forums
This is not legal advice. This has not been reviewed by a lawyer. It is up to you to do the research and determine what you need to do to make your forum compliant. Especially if your forum is popular, generates revenue, collects very sensitive/risky data, and/or has 250 or more employees, it is recommended that you consult a lawyer. If this guidance results in any damages, the person who drafted this guidance is not responsible. Any website or entity displaying this guidance (since it is free to share) is not responsible. Follow this guide at your own risk.
TL;DR
If you own a forum, you must understand the basic concepts of GDPR, and there are certain steps you need to take to ensure your forum complies with this law. Yes, even if you are not in the EU. Unless, you block all EU citizens from seeing your forum. Even then, your country probably has similar laws. But, don't be scared. Here you will see why you might not have to do certain things. Such as, why it's likely OK to leave posts in place after deleting a user's account. Plus, you may not need any fancy GDPR features, and you may not even need that annoying cookie banner notice. This guide isn't legally allowed to state anything with certainty though because the author isn't a lawyer.
Table of Contents
- What is GDPR and do I have to comply?
- Where does most of the information for this guide come from?
- What should I do first?
- Make sure what you collect is justified
- Tell people you are collecting their data and why
- What about security?
- Do I need a Data Protection Officer?
- Common user requests you may receive
- What about cookies?
- Anything else?
What is GDPR and do I have to comply?
GDPR (General Data Protection Regulation) was agreed upon by the European Parliament and Council in April 2016, and replaced the Data Protection Directive in Spring 2018 as the primary law regulating how companies protect EU citizens' personal data. The law lays out what website owners, companies, non-profits, and other entities need to help ensure this personal data is protected. Even if you are not in the EU, if you own a website and someone from the EU visits, then you need to comply. Or, block all EU IP addresses.
In a way, GDPR is nothing new. For centuries there have been privacy laws in some countries, and since the late 90s there have been some sort of Internet Privacy laws. If you have been a website owner since the 90s then you are very familiar with privacy policies and terms of service. You can think of GDPR as a slightly more robust version of the early laws.
Where does most of the information for this guide come from?
Most of the information referenced in this guide comes from https://gdpr.eu/checklist/. Some of the carefully researched opinions in this guide when it comes to how forums need to comply comes from years of reviewing various articles, as well as looking at how large forums handle GDPR.
In other words, this is an interpretation of an official GDPR checklist geared towards forums. At the end of the day, this is all anyone can do - interpret the law. This is what lawyers do as well.
What should I do first?
Review this checklist for yourself: https://gdpr.eu/checklist/
As stated above, this checklist is the foundation for this guide.
If you process high risk, very sensitive personal data, or have 250 or more employees, your first step is to assess the situation using a form like this. This will help you to remember to do certain things and add certain information to your privacy policy. Then file it away in a safe place in case you are audited.
If you run a small, niche forum that generates little to no revenue, and all you process is the type of data a default forum installation typically processes (i.e. username, email, password, IP address, and posts), then doing this assessment/form step is optional.
What's "high risk" data?
What exactly is high risk data? Let's just read text straight from gdpr.eu:
From Recital 75
... data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subject.
But wait, never read one part of a law like this and assume it 100% applies to you and that it 100% applies to every type of website, and all types of situations. GDPR also makes exceptions. Later in this guide you will see why many people, including lawyers, feel that the above does not count when it comes to actual forum discussion posts. Profile/account data? Yes. But actual forum posts? Maybe not. Keep reading this guide to find out why.
Make sure what you collect is justified
Again, let's look at actual text from gdpr.eu:
Processing of data is illegal under the GDPR unless you can justify it according to one of six conditions listed in Article 6.
Ok, thanks for that GDPR gods. Now, let's think about forums. With a basic forum you need to store a username, email, and password, and collect post content or else it isn’t a forum that people can participate at. Therefore, you are justified to collect all of that. However, as a non-justified example, collecting a mailing address at sign up may not be justified if that isn’t needed for your forum to run.
Thus, most small forums using most default installations will have justification by default.
Tell people you are collecting their data and why
Most forums do not come with a privacy policy by default. You will need to create one. One part of your policy should spell out, even if it seems obvious, all the data your forum collects. By default, this might only be: username, email, password (to create an account and keep your account and the forum secure), and an IP address (which is used for security/spam blocking purposes). Also, many web hosting services collect IP addresses by default and so sometimes there is no way around that. Other than owning a server you 100% control.
Finally, anything a user posts in a discussion or on their profile is collected data, but contributing to a discussion is optional. The user is not forced to type in personal information when creating a discussion. With account creation they are forced to provide a little personal information. Again, when creating a discussion they are not. See the difference?
Your privacy policy could even explain it in an easy to read way like this: As a forum contributor you must not post anything that could personally identify you. When drafting a new discussion or reply, users must ask themselves something to the affect of, "if I leave this forum one day and my account data is removed but post content remains, would people be able to identify who posted this?" In other words, just post normal discussion content. Don’t post your name, email, other contact info, in a forum thread and then the posts won’t identify you down the road. We truly care about you and your privacy which includes reminding you to think about what you post.
What about security?
From gdpr.eu:
You must follow the principles of "data protection by design and by default," including implementing "appropriate technical and organizational measures" to protect data.
This can be confusing, frustrating, and/or scary if you are a very small forum using shared hosting, for example. You are at the mercy of the web host. Most popular web hosts though will have their own clear privacy policy, and usually it will state how they protect data. Therefore, this part of your privacy policy could also link to their policy to show the data is protected by the web host.
Most high quality forum software takes security seriously and as soon a security issue is detected, the development team is transparent, fixes it as soon as they can, and announces once it’s fixed so you can update your forum.
Thus, typically almost by default, you will be able to check this box as complete (after building it into your privacy policy of course).
Anonymize where possible. In other words, if using analytics software that stores IP addresses, you can usually tell those systems to anonymize the IPs.
If possible, stay away from third parties processing your users data. But if you must do this, research how to stay compliant.
Create an internal policy
Create a security policy that ensures your team members (moderators/admins/etc.) are knowledgeable about data security. The internal policy should include guidance about email security, passwords, and what needs to be done if there is a breach or if a user requests something. Who at your forum will handle GDPR related requests?
Notify users if there's a security issue
Straight from gdpr.eu:
If there's a data breach and personal data is exposed, you are required to notify the supervisory authority in your jurisdiction within 72 hours. A list of many of the EU member states supervisory authorities can be found here. The GDPR does not specify whom you should notify if you are not an EU-based organization.
Do I need a Data Protection Officer?
No.
If you're big and important, yes. If you are a small forum, no. This is when you might need one:
- Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities.
- Large scale, regular monitoring —The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale.
- Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale.
Common user requests you may receive
- Right of access by the data subject
- Right to be forgotten
- Copy of data
Let's look at each of these below.
Right of access by the data subject
Be clear in your privacy policy what data you collect and why. Also, be clear if you do not plan on deleting the user’s posts once their account is deleted and why. The why is simple: a forum discussion will not make sense, help others, or continue to be a forum with a bunch of posts missing. If you disagree with this, then make it your policy that you will delete all posts by a user upon request. Simple.
It also should be easy for the user to edit/update their information. Most forum software allows the user to easily edit account data and posts.
Right to be forgotten
This is the most common debate I see in forums. What does right to be forgotten truly mean, for a forum. The law says that it should be easy for user to erase their personal data. Some feel this means the user should be able to click a button. But, others disagree because it is just as easy to email an admin and say, "delete my account." Easy is subjective. Thankfully the GDPR gods wrote a subjective law.
But what about their posts?
This is up to the forum owner. But, if you choose to keep the posts. I say don't worry about the naysayers especially if your forum is small. Why? Because most forum software removes the person's identifiable (username) information upon account deletion. They are anonymized.
But, but, that’s not compliant!
You say tomato I say tomotto. But, seriously, let’s look at this very closely by reading actual verbiage form gdpr.eu with additional commentary in bold under certain points related to forums.
The right to be forgotten appears in Recitals 65 and 66 and in Article 17 of the GDPR. It states, “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month.
An individual has the right to have their personal data erased if:
The personal data is no longer necessary for the purpose an organization originally collected or processed it.
Commentary defending leaving posts in place: Account login data then should definitely be removed. If the user doesn’t want the account, you don’t need their login information. But, forum posts, one can argue, are still necessary. Without them, many forum conversations will no longer make sense. Which damages the forum. Remember, user privacy is very important. But, not at the cost of damaging a forum/organization/business/or others' rights.
An organization is relying on an individual’s consent as the lawful basis for processing the data and that individual withdraws their consent.
An organization is relying on legitimate interests as its justification for processing an individual’s data, the individual objects to this processing, and there is no overriding legitimate interest for the organization to continue with the processing.
An organization is processing personal data for direct marketing purposes and the individual objects to this processing.
An organization processed an individual’s personal data unlawfully.
An organization must erase personal data in order to comply with a legal ruling or obligation.
An organization has processed a child’s personal data to offer their information society services.
However, an organization’s right to process someone’s data might override their [the user's] right to be forgotten. Here are the reasons cited in the GDPR that trump the right to erasure:
- The data is being used to exercise the right of freedom of expression and information.
Commentary defending leaving posts in place: This is sometimes citied as a reason a forum does not have to erase posts.
- The data is being used to comply with a legal ruling or obligation.
- The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority.
Commentary defending leaving posts in place: This could be used as a reason a public forum with posts about public safety, as one example, may keep posts. They are there for the good of the public.
- The data being processed is necessary for public health purposes and serves in the public interest.
Commentary defending leaving posts in place: A health forum might cite this as a reason posts are kept.
- The data being processed is necessary to perform preventative or occupational medicine. This only applies when the data is being processed by a health professional who is subject to a legal obligation of professional secrecy.
- The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
- The data is being used for the establishment of a legal defense or in the exercise of other legal claims.
- Furthermore, an organization can request a “reasonable fee” or deny a request to erase personal data if the organization can justify that the request was unfounded or excessive.
If you are a small forum with little resources, it might be necessary to charge a small fee for these requests as stated in the final point above. This helps ensure people aren’t making the requests just to make them. Essentially to spam you or your admins. Again, user privacy is extremely important, but it doesn't mean people can abuse your forum or staff. Or, maybe one request a month is free. Then you charge $50 for additional requests.
Do I have to give people their data if asked?
Yes, you should be able to send their personal data in a commonly readable format (e.g. a spreadsheet) either to them or to a third party they designate.
Once again, forum posts are typically not considered personally identifiable personal data. Therefore, this data export could end up being nothing but: username, email, and IP address. Furthermore, major CMSs like WordPress only provide features to export user account data. Not actual posts.
What about cookies?
They are delicious. Who cares if they are unhealthy.
Oh, Internet cookies? Ok.
If you are only using a default forum installation, no ads, and you aren't doing anything crazy like tracking users activities in a weird way, or letting a third party cookie track them, then a cookie pop up notice may not be necessary. Always talk about cookies in your privacy policy, but you may not need an actual in your face notice. Typically you only need that if you are using cookies which are not required for the website to work.
Here's a cool site you can link to in your privacy policy to explain cookies: https://www.cookiesandyou.com/
Anything else?
Finally, just make everything very clear and easy. If a user needs to object to something or contact you, make it easy and obvious. And sure, there's more. Such as what sections your privacy policy should have, other laws, and so on and so forth. But, this should help you to be less scared of GDPR.
Don't let GDPR scare you. The Internet is still a free and open place to express yourself. And, its still a fun place to run a community.
