Product Guru

How To Erase A User From Your Community

Forum|Forum|8 years ago
May 23, 2018
19 replies
1302 views

The right to erasure, also referred to as the right to be forgotten, is one of the main principles of the EU General Data Protection Regulation (GDPR). It sets a new standard for how companies use and protect EU citizens’ data and applies from 25 May 2018.

The Regulation describes erasure as the process by which information is rendered inaccessible and unusable for all relevant parties. Personal data can be erased in a number of ways, including by masking the relevant personal information, so long as the erasure is irreversible, even by the institution carrying out the erasure process. That is also known as the anonymization of personal data records.

You can erase a user via our API, or by using the ‘Erasure User’ feature available on the user profile page in Control.

The feature initiates the user erasure process, which can take up to 30 days.

The system will remove the following data from our platform:

The user’s profile (including all profile fields).
The user’s private message conversations (any conversation which the user was in - including for the other user in the conversation).
References to the user in our analytics platform.
References to the user in our search platform.
Subscriptions from the user to specific content.
Ranks/Badges received by the user.
The user’s position on the leaderboards

We will also anonymize all the user’s posts and likes. Erasing the posts of a specific user from a community would drastically affect the integrity and consistency of community conversations and render them unusable to transfer knowledge and help other customers. To avoid this, we will be using true anonymization for the posts to make sure we don’t have to remove public community content, while ensuring that personal data in fact will be removed where needed.

Personal data from the specific user in the following data containers will be erased in the next 23 days.

Log files
Backup files
References to the user in all data exports.

We store audit log files for 180 days to ensure the capability to investigate possible threats. These log files only contain IP addresses, and no reference to the user profiles.

⚠️ Once a user is erased, it is not possible to recover the account.

Mathis

Contributor ⭐️⭐️⭐️

Hi @Frank

Thank you for this update. I have one more question about this.

Since our community-sign up works exclusively with SSO, I am wondering if the oauth ID gets removed as well when we click the “erase user” button from control?

From what I understand, this determines whether or not a user can join with the same SoundCloud account at a later point, or if the ID gets blocked and we have no option to “free up” the ID any longer?

Thank you Frank.

Cheers

Suzanne_Kindertelefoon

Contributor ⭐️⭐️

Hi everybody,

I am curious about the way other communities are going to use the 'Erase button'.

Are you going to use this option only at the request of users?

Or also for users who have not been active for a number of years?

Our forum is for children up to 18 years. So we actually want to remove all personal data from everyone older than 19. But we're worried this might have a big impact on the community.

That's why I'm curious what you do with 'old' users?
After how many years do you clean the user file?

Suzanne

christophrooms

inSided Product Team

@Mathis

If a user is erased, then also his oAuth id will be removed. His whole profile will be erased.

Assuming the user would not be removed from the central SSO system, this means that the user could after erasure in the community register again in the community and a new user account will be created. That user won't be linked to the post the user made before.

Niels Kamper

Helper ⭐️

And what about 'plain text' mentions? If I understand correctly all the @Niels Kamper (mentions) will be converted to the ‘anonymous’ name. However, a lot of users also use a mention without the @ feature, eg: “ Hi Niels Kamper, Hi N Kamper or Hi Kamper. These are plain text ‘mentions’ and usually used when quoting a comment. So you have an anonymized post, but right below the anonymized post a user referring to the original poster. Does this fall outside the purview of the GDPR? Or do we need to make an export of all the posts and lookup/edit the plain texts mentions ?

Suzanne_Kindertelefoon

Contributor ⭐️⭐️

And what about 'plain text' mentions? If I understand correctly all the @Niels Kamper (mentions) will be converted to the ‘anonymous’ name. However, a lot of users also use a mention without the @ feature, eg: “ Hi Niels Kamper, Hi N Kamper or Hi Kamper. These are plain text ‘mentions’ and usually used when quoting a comment. So you have an anonymized post, but right below the anonymized post a user referring to the original poster. Does this fall outside the purview of the GDPR? Or do we need to make an export of all the posts and lookup/edit the plain texts mentions ?

|I have the same concern! Is it possible to make some kind of
'search and replace function' to replace those names mentioned?

christophrooms

inSided Product Team

And what about 'plain text' mentions? If I understand correctly all the @Niels Kamper (mentions) will be converted to the ‘anonymous’ name. However, a lot of users also use a mention without the @ feature, eg: “ Hi Niels Kamper, Hi N Kamper or Hi Kamper. These are plain text ‘mentions’ and usually used when quoting a comment. So you have an anonymized post, but right below the anonymized post a user referring to the original poster. Does this fall outside the purview of the GDPR? Or do we need to make an export of all the posts and lookup/edit the plain texts mentions ?

We will remove next to all @Mentions, all references to the username. We we are not removing variations of that name. There is simply no way for us to do that.

If a user complains about this, then the posts should be updated one by one by a moderator.

Niels Kamper

Helper ⭐️

I understand that deleting the variations is not feasible.

Good to read that all the references to the username will be deleted

Kat

Contributor ⭐️⭐️

@Suzanne_Kindertelefoon Hi Suzanne, did you get your answer about inactive accounts? Do you know if there is any procedure for that? I have not found this information in the documentation. Cheers.

ThomasMalingre

Contributor ⭐️⭐️⭐️

@Suzanne_Kindertelefoon Hi Suzanne, did you get your answer about inactive accounts? Do you know if there is any procedure for that? I have not found this information in the documentation. Cheers.

I'm curious about this as wel @Suzanne_Kindertelefoon , any info on this? 🙂

Jr. Community Manager Simyo >> Always happy to share info and experiences

Shane1

Helper ⭐️⭐️⭐️

Hi @Suzanne_Kindertelefoon, @Kat & @ThomasMalingre we don't have any plans to automatically remove any activated accounts, even if they haven't been active for a certain amount of time. For Kindertelefoon I can see why you would like this but for other communities there is a danger that some users only visit the community when they have an issue, and you've deleted their account and details when they may have come back in future.

Show more replies

Didn't find what you were looking for?

Sign up

Welcome to the Gainsight Community