getDare and GDPR

[EnglandBoy]

It's come to my attention that EU users are not able to delete their getDare accounts despite the fact that this is a requirement under GDPR (which applies to getDare even if it isn't located in the EU). How can EU users get their accounts deleted?

[MeisterRebus]

Like everybody else. They write a short notice to Butterfly, one of the admins. She will ban your account so it becomes inactive.

[siliconavatar]

I think you've misunderstood what EU GDPR laws actually require with regards to account deletion.

[cloudness]

Originally Posted by siliconavatar

I think you've misunderstood what EU GDPR laws actually require with regards to account deletion.

Maybe, but GetDare is a US based website and their for under US laws not EU ones I believe.

[lotusdriver81]

GDPR has extra-territorial scope. Websites outside the EU that process data of people inside the EU are obligated to comply with the GDPR. So GDPR applies to GD regardless of where it is based.

This also includes the “Right to erasure” I believe. But there are other clauses that may require data to be kept for other reasons.

Wether GD complies with these rules would be a matter for more informed people than myself.

[lumine]

Originally Posted by lotusdriver81

GDPR has extra-territorial scope. Websites outside the EU that process data of people inside the EU are obligated to comply with the GDPR. So GDPR applies to GD regardless of where it is based.

This also includes the “Right to erasure” I believe. But there are other clauses that may require data to be kept for other reasons.

Wether GD complies with these rules would be a matter for more informed people than myself.

You're right, while i'm not personally bothered by this i feel this is kind of an important thing to keep in mind, breach of gdpr can have some really nasty consequences for an organisation. Some observations:

Privacy policy

Our advertisers also collect information about you as well. For more information on what sorts of information they collect and what they do with it you will need to visit their sites and evaluate their policies.

By sending communications to getDare you give us permission to display that content for any reason. By posting content you agree to let us display it indefinitely. getDare does not remove posts or accounts on request. If this bothers you, don't register and post.

GDPR

Art 3 (1)

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

Art 7 (3)

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

Art 17 (1-2)

1.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

2.
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

definitions

full text

Now to be clear I'm not a solicitor or anything of the sort, however the main points I gather here is that GD privacy policy explicitly says they won't erase your information from the site, nor will they contact third party processors (advertisers) to inform of your request in accordance with art 17 (right to erasure).

GDPR details in chapter 8 the rights of the data subject to lodge complaints for breach of the regulation as well as any possible penalties to the controller/processor if they're found to be in breach of the law.

Like as someone who has had to think about these things in work/generally it's kind of extremely important to comply with gdpr, same with CCPA (the Californian regulation) if applicable (i'm even less qualified to talk about US law so i'll just leave that there)

Basically, afaik gdpr applies whenever the data subject or controller/processor is within the EU, either is enough and the penalties can be pretty severe. I also believe there's provisions on transfer of data to a country outside of EU which the subject needs to explicitly consent to

[lotusdriver81]

Like many others this doesn't really bother me as there is no real link between this site and my real life and I'm ok with GD policies personally but I do wonder if this policy constitutes a breach of GDPR requirements. I wouldn't want the site to get into trouble because of it, as you say, the fines for non-compliance can be very severe.

I'm not even sure who is responsible for GDPR compliance on GD.

"By sending communications to getDare you give us permission to display that content for any reason. By posting content you agree to let us display it indefinitely. getDare does not remove posts or accounts on request. If this bothers you, don't register and post."

[Ace_E360]

US based and also not a lawyer (and I do hope the good staff of getDare have consulted one) but there's two added wrinkles:

As I read it, the GDPR right to erasure specifically entitles you to the deletion of identifying personal information, not the deletion of your digital existence. Arguably, they could comply by changing the username, email, and any other metadata associated with an account to a random string of characters and fully comply with the erasure clause. Everything else, they could argue, is indeed as easy to consent to as to remove - you consented by posting it, and it's as easy to edit the post and remove it as it is to make the post. Without going through a massive search for case law, that doesn't seem too farfetched.

That overlooks a bigger GDPR issue though: GDPR is extraterritorial, but the EU's enforcement capabilities are not. Sure, the EU can say a US based website has violated the GDPR, but unless that website has a business representative physically within the EU, there's pretty much nothing else they can do. It's highly unlikely (given existing precedent for lack of US compliance with other extraterritorial enforcement like the International Criminal Court) that a US court would elect to enforce GDPR fines against a US entity.

[EnglandBoy]

GDPR doesn't specify it's any personally identifying data - any data at all must be deleted if a user withdraws their consent, with the only exceptions being for things like law enforcement. Art. 4:

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"

A name or online identifier should quite comfortably cover getDare usernames. Otherwise, getDare specifies in its own privacy statement that it collects other identifiable data. This means any data getDare has on you - including posts and PMs - is "personal data" under GDPR. GDPR applies to any organisation that targets its services at EU/UK users, which getDare does.

GDPR is specific about consent. Art. 7:

"The data subject shall have the right to withdraw his or her consent at any time."

Informed and continuous consent is ESPECIALLY important in a context such as getDare where sensitive and sexual information is held and stored. What the current privacy policy is effectively doing is stating, unlawfully, that they don't care about informed and continuous consent with regards to data processing, despite the sensitive nature. GDPR is also clear on the right to erasure - and erasure means erasure, not simply being banned. Art. 14:

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;"

Art. 6(1):

"Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;"

It is, in my view, crystal clear that getDare is seriously breaching the laws and data rights of its users in the EU and UK by refusing account deletion. This runs the risks of fines and being forced to pay compensation to users - including for, as the GDPR puts it, "material or non-material damae as a result of an infringement of this Regulation".

This is definitely something that getDare should get onto before it escalates as it is very apparent that it is currently in breach of the law in quite a sensitive subject area, and it is very open about being in breach of the law. Similar legislation also exists in California (CCPA), so even if getDare is outside of GDPR jurisdiction it is likely within CCPA jurisdiction.

[Kevb6240]

I know "getdares" current rules on account deletion but what I don't know is why?
It's can't be that hard to put a button on accounts that justs deletes them. Even if it doesn't delete public posts or forums threads removing the profile and user name isn't that hard and will save them alot of legal issue down the road.

[DeepInnerFreak]

I want to say something because this thread is pissing me off.

Before I start, I am in no way affiliated with getDare as an owner nor have I ever been a member of staff. I am simply an account holder, like most of you. Some of what I argue is based on assumption, some of it is based on information I already know about the site having used it for many years.

getDare is what it is; An old platform that became more successful than it's original purpose. It is not some big company with huge pools of money with paid staff and a legal team.

getDare, as far as I am aware, is very cheaply run and makes very, very little money. It likely just covers the cost to run the servers. It was designed to be a place for people to have fun, and explore dares, back when the internet was a lot more fun. Nothing more.

It may be that the website is built in a way that is not compliant with the current bureaucracy. It looks to be using very old software and I am confident the back end is clunky and non-user friendly. I mean, the front-end is hardly easy to operate at times. I know a few other websites that use a similar forum layout/function which also have this same problem. It is not an issue for just getDare.

I believe there are two problems. Firstly I don't think the tech software behind the site allows for posts/accounts to be deleted, hence the trashcan thread. Secondly, even if that function was there, who is going to do it? They have no staff, just unpaid volunteers. The only person that really ever did anything has now left.

Realistically, the majority of users do not use their own name, upload real photo's of themselves or have their accounts set up in a way that would be easily identifiable as them in their "vanilla" world.

Personally I would be more concerned about the actual tech giants who do own your pictures, personal search history, data and metadata. Even if they "delete" it from public view, they still keep it. Go cry at them.

Nothing you ever post on here, any other website, app, SMS message or other digital footprint is ever truly deleted.

We live in a world where people seem quite happy to point the finger at others. They think they are safe or smart in hiding behind or regurgitating some law or statement, to make themselves feel better or look big and clever, without actually thinking the consequences through and taking responsibility for their actions.

When you set up an account, you are told posts and accounts are not deleted. If you are not happy with this, then don't set up an account and post. Choosing to take that step is your responsibility as an adult with a brain. It seems a little strange to know this information upfront and then point it out as a flaw at a later date.

If GDPR laws are so important to you, then why set up an account on a site that has indicated that it likely can not adhere to them?

As an adult, looking at your arguments, I see three options for you;

1. Accept what it is and move on. Find similar websites that can offer you what getDare does for free (good luck with that by the way).
2. Seek legal advice.
3. Set up your own website.

The outcome of all this pissing and moaning will likely just end to the site being taken down. It is not worth any of the stress to the owner(s) that your arguments highlight. They will not start paying people to do what you want them to do and it will not pay to modernise the software. It will not result in any monetary reward for account holders or fines as the money to do this just doesn't exist.

If the site does get taken down then great! I hope you feel big and clever.

[EnglandBoy]

1. GDPR is law, getDare's privacy policy doesn't trump it.
2. My understanding of vBulletin 3.8.11 is that you can delete users and their data from it.
3. If one day I decide I don't want my IP address associated with a list of kinks and vulnerable messages, that's my moral and legal right.
4. All I want is communication from getDare as to WHY they don't do this - if there's a good excuse and data is safely protected, I think a lot of people would be more sympathetic than they are towards a privacy policy which effectively says "your data is ours to share if you piss us off". If there isn't, that's where there's an issue that should be resolved. I don't think I'm being hugely unreasonable when I haven't had a reply from GD in the week since I posted this.

[DeepInnerFreak]

Originally Posted by EnglandBoy

1. GDPR is law, getDare's privacy policy doesn't trump it.

I agree. I never said it didn't or argued that getDare or any other site should not have to follow the law. I simply stated that they were clear and transparent from the start, leaving you able to make an informed decision.

Originally Posted by EnglandBoy

2. My understanding of vBulletin 3.8.11 is that you can delete users and their data from it.

That may well be the case. I genuinely have no idea. I am not a web developer. However the site stated that it will not delete your account or posts when you signed up, so why you are now so shocked and perplexed that this isn't being offered after the event is odd.

Originally Posted by EnglandBoy

3. If one day I decide I don't want my IP address associated with a list of kinks and vulnerable messages, that's my moral and legal right.

Living comes with risks everyday. Crossing the road, driving a car, playing sports, bungee jumping and skydiving, for example. Everyday we assess those risks, mitigating and minimising them where we can.

Reveal as little about yourself as you can on the site. Move to more trusted means of communication for more intimate conversations is one way to minimise those risks.

As for your IP and metadata, just because getDare deletes your account and posts, it will not stop your ISP from holding the data that your IP address has interacted with. This is kept on file and legally accessible for 12 months in the UK but after the 12 months, it will still be there. Nothing is ever deleted. Best way to be safe is not to do it in the first place if you are that concerned.

Originally Posted by EnglandBoy

4. All I want is communication from getDare as to WHY they don't do this - if there's a good excuse and data is safely protected, I think a lot of people would be more sympathetic than they are towards a privacy policy which effectively says "your data is ours to share if you piss us off". If there isn't, that's where there's an issue that should be resolved. I don't think I'm being hugely unreasonable when I haven't had a reply from GD in the week since I posted this.

I agree. I do not think you are being unreasonable asking a website what it does with your data. It's the reason I do not have any social media accounts. No Facebook, No Twitter, and certainly no Tiktok. However the website has already told you what it does with your data and that it won't get deleted, so you have your answer.

As to why they do not delete accounts, I have no idea. You likely will not get an answer either. The site, as previously mentioned is run by unpaid volunteers. You likely have better knowledge then them regarding GDPR laws. They are just people like you and me who enjoy using the site and wanted to help support with it's running.

EDIT: Most likely it is a resource reason... they simply do not have people that can press that button. It may also be because it would leave the site looking patchy and messy.

getDare was literally set up as a small project and it has grown beyond it's intended popularity. Initially by the owner(s) and then through said unpaid volunteers. It is not a business that makes any tangible profits.

I am simply responding to several users in this thread as a user of this site that understands what it is. Just trying to help you understand why you are likely not getting a response from anyone... because there really isn't anyone to respond or has the answers you are looking for.

[wolf82]

I have zero idea of what is what, BUT a quick search of the site shows threads on this debate dating back to 2018.

The key takeaway from the threads has been the same, from Butterfly: mods don’t have the power to to delete accounts.

The issue, she has stated, needs to be brought up with Depp (site owner), who, at the time of the post in 2018 from Butterfly, is not on gd very often. (Unsure if he is around much or not these days)

Just throwing that out there