EU's GDPR

[Mark.B]

Very little assistance? We are adding GDPR support into vB5. This has been a major project.

We cannot provide legal advice however. You will need a lawyer for that.

[jagtpf]

As far as I'm aware vBulletin and consulting their lawyers on interpretation of GDPR, I don't blame them for not offering much information until this is complete as people would take what they say as fact.

It's a risky business offering assistance until you know what is the correct thing to say.

Indeed ....

And yet they seem to know what to do with v5....

[Mrs.T]

As there has been very little assistance provided by vBulletin

As far as I'm aware vBulletin and consulting their lawyers on interpretation of GDPR, I don't blame them for not offering much information until this is complete as people would take what they say as fact.

It's a risky business offering assistance until you know what is the correct thing to say.

[Peter Walker]

As there has been very little assistance provided by vBulletin, I found this page on the Xenforo forum website. It answers a lot of questions, missing here.

https://xenforo.com/community/threads/upcoming-changes-for-gdpr-compliance-in-xf1-and-xf2.146888/

[jagtpf]

If I want to delete a user in admincp, it tells me that "All posts made by this user will be set to 'Guest.' "
If they are banned anyway and posts can only be viewed by current members, then how would they know if their posts were still there or not?
You can also "Find Latest Posts by User" Select All and then delete posts.
Sure, this can be laborious if they have made hundreds of posts.
But is this needed - surely setting their username to Guest is sufficient.

Is setting their username to 'Guest' sufficient.

That I don't know, and I doubt anyone would be able to confirm without a legal case being examined.
In our site a user can identify their own threads easily, even if their usernames are changed to 'guest'.
They are posting their own work for discussion etc, so it's feasible.

Is setting to 'Guest' in this context satisfactory under the terms of the GDPR?

My main concern is the knock on effect on the database tables of deleting thousands of threads/posts from one individual. As the software wasn't
designed with mass deletion on the table ( hence an easier solution to change to Guest ) - I'll ask again - can the software cope?

I am asking because a previous owner of the site deleted a few hundred (I don't know how he did it) but the action damaged the tables in some way.

Obviously deleting threads changes each post count for members who commented on the thread.

[Peter Walker]

If I want to delete a user in admincp, it tells me that "All posts made by this user will be set to 'Guest.' "
If they are banned anyway and posts can only be viewed by current members, then how would they know if their posts were still there or not?
You can also "Find Latest Posts by User" Select All and then delete posts.
Sure, this can be laborious if they have made hundreds of posts.
But is this needed - surely setting their username to Guest is sufficient.

[jagtpf]

I'll ask the main question, again.

Can the software cope if members demand a deletion of their threads/posts?



We have, over the years, a number of very awkward members - at least one who was particularly vicious. They have been banned.

If one of these asks for some thousand threads/posts to be deleted, can the software cope - I know it can only be deleted manually for large post counts.

If more than one of these makes the same demand?

There's no clarity on whether changing their usernames to 'guest' will be sufficient.

They remain banned in order to help stop them re-registering, which has worked for most.

[jagtpf]

Indeed, one can hope....

[Mrs.T]

I've no legal knowledge so this is just my personal opinion.

Unless a members post content can actually identify them I would have thought changing them to guest and removing personal info from their account should be enough.

I dont think members will care about gdpr after a while, just like the cookie policy, it will be ignored.

[jagtpf]

Two of us run a Forum as a private club with members.

The GDPR seems a sledgehammer of regulations that is likely to impact (?) many Forums like ours.

I'm hoping it's not going to come to us having to close because of these new regulations. We can alter out T&Cs and find a way to get all members to accept, but I worry about those who are banned - their usernames/emails and IP addresses are retained on the database in order to help prevent re-registration, whilst others are there to help prevent spamming.

If a member, inactive, for (say) 5 years, asks for their account to be deleted, the software replaces the username with 'guest', thus breaking the link between post/thread and user.
If, however that same member requests a guaranteed deletion of all their contributions on the Forum, can the software cope - indeed can it cope if dozens of members request the same?

Does anyone with a similar Forum have any suggestions on how to move forward on the compliance with the GDPR - we certainly don't have the funding to request specific legal advise!