3 ms·

Thanks! May I ask how you would handle this scenario - A blog has a commenting feature where users can type in their name (possibly full name) and a comment. Th

Thanks! May I ask how you would handle this scenario - A blog has a commenting feature where users can type in their name (possibly full name) and a comment. There is no user registration or email address collection/verification. Any user on the internet can type in a name (an anonymous name or a real name like Bob Yan) and their comment and submit it. Web server access logs are kept in the server for 30 days. Does it fall within the scope of GDPR? If yes then how is the right to have personal data erased implemented? How would you process a request from someone with the name Bob Yan asking you to delete all comments posted by 'Bob Yan' on your website? Without a user registration or an email, how would you verify that the Bob Yan contacting you is the one who posted all those comments? This part seems to be very confusing. I'd appreciate any knowledge or tips you can share about this.

ThePowerOfFuet 4y ago
If the blog is purely for personal/household use, it would be entirely exempt from the GDPR per Article 2(2)(c) GDPR. Otherwise, it falls within the scope of the GDPR even re the access logs if IP addresses are logged.
- eminent101 4y ago
  Thanks for the answer! The blog has visitors from other geographic locations (both in EU and outside EU). Those visitors also post comments with their names included in comments. Those comments are then made available on the internet. So I am doubtful if it falls in purely personal use category. https://gdprhub.eu/Article_2_GDPR https://gdprhub.eu/Article_2_GDPR says: > According to Lindqvist in particular, the publication of personal data on a blogging site made available to an unlimited number of people would 'obviously' not be subject to the household exemption. For now, let us assume that the commenter name and IP addresses fall within the scope of GDPR. Do you have any comments about how the right to erasure would be implemented in the scenario I described in my comment above?
  - ThePowerOfFuet 4y ago
    The right to erasure is not absolute; there is no basis to request erasure of web server access logs, for example.
  - mytailorisrich 4y ago
    Yes, a blog cannot claim to be "purely for personal or household use" because it is an online publication and so the GDPR applies. I think you are falling down the "GDPR rabbit hole" here, though. As said, for a personal blog the most probable scenario is that no-one will care about your following the law strictly to the letter. Now, you can reasonably argue that you have a legitimate interest in logging IPs and to keep them for a sensible duration for security audit purposes. So in any case, you can just inform visitors that you will log IPs for security/spam prevention purposes and move on. Commenters do not necessarily have a right of erasure and as you have said you probably won't be able to check that requests are genuine, anyway. So I think a sensible approach is not to worry about that until and unless you receive such a request and then decide what to do to make your life the easiest possible. For instance, if one day someone claims to be the author of a comment and wants it deleted you might decide to just delete it and to move on whatever the strict legal position and procedure might be.

ThePowerOfFuet 4y ago

If the blog is purely for personal/household use, it would be entirely exempt from the GDPR per Article 2(2)(c) GDPR. Otherwise, it falls within the scope of the GDPR even re the access logs if IP addresses are logged.

eminent101 4y ago
Thanks for the answer! The blog has visitors from other geographic locations (both in EU and outside EU). Those visitors also post comments with their names included in comments. Those comments are then made available on the internet. So I am doubtful if it falls in purely personal use category. https://gdprhub.eu/Article_2_GDPR https://gdprhub.eu/Article_2_GDPR says: > According to Lindqvist in particular, the publication of personal data on a blogging site made available to an unlimited number of people would 'obviously' not be subject to the household exemption. For now, let us assume that the commenter name and IP addresses fall within the scope of GDPR. Do you have any comments about how the right to erasure would be implemented in the scenario I described in my comment above?
- ThePowerOfFuet 4y ago
  The right to erasure is not absolute; there is no basis to request erasure of web server access logs, for example.
- mytailorisrich 4y ago
  Yes, a blog cannot claim to be "purely for personal or household use" because it is an online publication and so the GDPR applies. I think you are falling down the "GDPR rabbit hole" here, though. As said, for a personal blog the most probable scenario is that no-one will care about your following the law strictly to the letter. Now, you can reasonably argue that you have a legitimate interest in logging IPs and to keep them for a sensible duration for security audit purposes. So in any case, you can just inform visitors that you will log IPs for security/spam prevention purposes and move on. Commenters do not necessarily have a right of erasure and as you have said you probably won't be able to check that requests are genuine, anyway. So I think a sensible approach is not to worry about that until and unless you receive such a request and then decide what to do to make your life the easiest possible. For instance, if one day someone claims to be the author of a comment and wants it deleted you might decide to just delete it and to move on whatever the strict legal position and procedure might be.