Hello,
I’m no longer using my NixOS Discourse account and would like it to be anonymized or deleted.
I prefer not to keep inactive accounts for security reasons.
Thanks in advance.
2 Likes
This is not the first request of this kind in our forum, and generally my reading of the GDPR is that this should be a self-service option which we are required to provide. A preliminary glance into the Discourse settings says that users with more than n posts (where n is an admin-configurable limit) are not allowed to delete their own account anymore, which in my layman’s interpretation is not GDPR-compliant. The limit should instead be disabled, allowing everyone to delete their account via the account settings.
5 Likes
By my understanding of the GDPR, self service is not required, neither for deletion, nor for asking for all the stored data.
Service providers are allowed to require written form.
There are other regulations that demand that canceling a subscription has to be as easy as the subscription itself, though I am not sure if an account on a forum platform falls under this reulations.
I agree though, we should not require a public post asking for deletion. There should be a group to DM, an email to write to, or something like that.
3 Likes
legal requirements aside, it seems a bit silly and a waste of everyone’s time to make account deletion any harder than clicking a button. if there’s no situation in which an administrator would decline to delete an account (and I can’t personally think of one), why involve them in the first place?
3 Likes
Because, as far as I know, Discourse doesn’t offer the feature to self-anonymize.
“Deletion” in the Discourse meaning erases all the content of any type from the user. This makes that content simply dissolve as if it was never there. This means topics either disappear, taking a lot of other users content along with them or can substantially change the meaning of historical topics when the flow is broken.
On most forums, the staff don’t even have the ability to delete users after they have more than a few posts.
3 Likes
Is there a policy on this? Can any user request that their account and content be purged?
The following rules govern the account retirement process:
- Users cannot be deleted while they still have posts
- Posts cannot be deleted when they’re older than 60 days
- Anonymization is always an option
Discourse does not offer self-service for these things. Instead, an admin needs to be contacted to execute the request within the given limitations.
6 Likes
But does a channel exist, and is it publicly advertised, to request deletion without the necessity of a public post, that in my opinion counters the intend of an anonymisation, as a user in bad faith might keep record of the public request for anonymisation/deletion.
Also, at least for the european customers, how does this conform to their rights according to the GDPR, namely the right for deletion?
I assume that the NixOS foundation is the official “owner” of the forum, which again is a dutch non-profit organisation and therefore has to comply to the GDPR (for european users at least) as far as I understand the GDPR.
3 Likes
I hope we can keep the de facto rule that posts can’t be deleted, but of course we should comply with the GDPR so I hope we can resolve this by someone from the Foundation mandating an official email address for privately requesting to be anonymised.
You can already privately request that by DMing an administrator.
I won’t speak to the rest, since I’m no legal expert.
1 Like
Just for the sake of avoiding unnecessary attention spend, I’d prefer if the discourse mods/admins would delete such posts (after processing the request or redirecting the user to DM admins), since they generally serve no purpose to keep around. Since this one has some substance to it now I guess we can keep it around, but I’d still prefer it to get muted.
From a legal perspective I see no issues, but if anybody believes there is one, please reach out to foundation@nixos.org.
1 Like
I know some discourse does this anomising user so posts are still there and then remove the account/delete. I have no idea how they do this in general, but example in fedora discourse you request account deletion and the user gets random anon1234 account and then the requested user is deleted
Fedora has a separate accounts system integrated with discourse so they have to do the anonymization and then delete the account.
In most Discourse scenarios, you only need to do the anonymization. It removes all the account information.
2 Likes