General Data Protection Regulation <GDPR>

[Mister X]

Heyho @Ashal @CPU,

Something just came to my mind: some time ago, the GDPR was settled by the EU. Many websites gave their users the opportunity to choose which cookies and stuff may be used and which not.

Still, I didn't see something like this yet for LL. Maybe, I just was too tired and chose something random, that's possible, too ^^

 

I'm absolutely not paranoid and hopefully you shouldn't even be able to gather too much data about me  Still, it's a big site and somebody could have the weird idea to tell this issue to a lawyer. It just would be a shame and a pity if this site would go down because of the new regulations. 

[Guest]

Technically we are compliant, because everybody can ask to be fully removed from our site/database.

As you can see, we do not have anymore the track of deleted users (if they are gone now they are gone for real.)

 

About the "we use cookies" message, maybe we will add one. Annoying but why not.

[Mister X]

IIRC you also have to tell who can get the data (eg all the ad providers) and what they use the data for, as well as offer a possibility to opt out of any tracking method those ad providers and you may use. Additionally you have to offer the possibility for users to get all data at any time you currently have about them.

I have to add, I'm no lawyer myself, so maybe it could be a good idea to ask a professional about this, too. Still I'm quite sure that simply removing any data from deleted users isn't enough anymore.

[Guest]

9 minutes ago, Mister X said:

IIRC you also have to tell who can get the data (eg all the ad providers) and what they use the data for, as well as offer a possibility to opt out of any tracking method those ad providers and you may use. Additionally you have to offer the possibility for users to get all data at any time you currently have about them.

I have to add, I'm no lawyer myself, so maybe it could be a good idea to ask a professional about this, too. Still I'm quite sure that simply removing any data from deleted users isn't enough anymore.

You have to comply to a few things:

• access -> people should be able to ask and receive information about what data we store
• rectification -> people may ask anytime to update the data we store (we are compliant because you can edit all your information and able to delete and alter it, and you can ask the staff to alter/delete the referenced data (remove some of your data in a post from another user))
• restriction -> you can ask that your data will not be used (we do not use any sensible data, emails are just to send you notifications and IP for tracking attacks/spam, this data can be removed in case you opt out.)
• be forgotten -> you can delete your account and you can ask to the staff to remove all your posts
• objection -> you can report to us that your data is not valid (email and posts) you have full power to edit them without needing the staff to act
• deletion -> same as "be forgotten" for the personal data we handle (emails and IPs, we do not store any other PII info)
• portability -> does not really apply to us. The only item is that if you change your email all your old posts will be re-linked to the email, and that is the default.

Keep in mind that we do not really handle real information (except emails and visitation tracks), for example you don't need to put any info about name, country, phone, gender. Some of the info are not really linked to the real person.

[Mister X]

Like I said, I'm no lawyer, I just wondered as I didn't see any changes, unlike any other website had  

When you say that you comply with this, I'm fine! It would be really a pity if you would get sued because of seemingly not considering that new law.