Dont purge posts/comments when user deletes account (ref #2426)

[Nutomic]

Based on the comment below by kromonos in Matrix, GDPR only requires operators to delete the following personally identifying information:

• Name (nickname is part of it) and address
• E-mail address / Internet address
• Identity card number
• IP address
• Other individual data, such as (gender, title, height, hair color, telephone number, account data, record of working hours, location data, vehicle license plate number, audio recordings of voice, photo, answers of an examinee and comments of the examiner on this, opinions and assessments on the part of the data subject and about the data subject e.g., about his creditworthiness, his sexual orientation, work performance).

Posted content is not part of it, so there is no legal problem if we leave it. Deleting such content is also bad for the ecosystem, because valuable information disappears.

We should update the account deletion message to account for this, and tell the user to delete individual posts/comments before deleting the account, if desired.

[dessalines]

The GDPR stuff is less important to me than what someone intends by deleting their account: they probably don't want any of their content publicly visible.

We can preserve their content in the DB by just setting deleted: true, but not overwriting any of the content-type columns. Still a bit scary because I'm not sure which of those fields might still be publicly visible.

[dessalines]

This section still needs to be here, especially the deleted.eq(true). You just don't need to overwrite the content.

Otherwise all their posts and comments would still be publicly visible.

[dessalines]

Same here, just make sure deleted.eq(true) stays.

[egasimus]

How about giving a user a "delete all my submissions" checkbox upon account deletion? It would introduce some complexity, sure, but it seems like a worthwhile option nonetheless. deleted: true is, well, unethical - to both users and server operators, either of which might not be aware that this is going on under the hood (which might theoretically get the server operators in trouble down the line) - what if the user has posted their GDPR-protected PII as content?

[dessalines]

Seems like it would be worthwhile to add that option, but we're still left with the same question, since there are 3 possibilities:

• Delete my user but leave my content up.
• Delete my user but make everything publicly invisible and only viewable in the DB (IE only set deleted= true). This also means its possible to easily resurrect.
• Delete my user and overwrite all my content.

[egasimus]

Check box toggling between #1 and #3 upon user-initiated account deletion is what users would expect.

[Nutomic]

The GDPR stuff is less important to me than what someone intends by deleting their account: they probably don't want any of their content publicly visible.

What makes you think like this? If i delete my account, its because i dont want to use it anymore, doesnt mean i want to delete all the comments which i spent a long time writing. I would handle this with a message on the delete profile button, telling the user to manually delete all comments with personal data if desired (or to use a script to wipe everything).

If each user deletion means that all posts from that user disappear, it will have a very bad effect in a few years, there will be holes in all discussions, and valuable replies will be missing.

[dessalines]

A main reason people delete their accounts, is because they doxxed themselves in their content. They def don't want to have to run a script when we can easily overwrite their content for them.

there will be holes in all discussions, and valuable replies will be missing.

Just a note that this doesn't DB delete the comments (which would wipe out entire trees) or posts, but only overwrites the content. So other peoples' data is still safe.

Check box toggling between #1 and #3 upon user-initiated account deletion is what users would expect.

That makes sense to me, just to add an optional checkbox for "delete my content".

[egasimus]

If i delete my account, its because i dont want to use it anymore

This can be achieved by just not using the account, no need for deletion.

If each user deletion means that all posts from that user disappear, it will have a very bad effect in a few years, there will be holes in all discussions, and valuable replies will be missing.

Each user's posts belong to that user. If at some point someone decides they want to delete all their contributions, it is right to give them a way to do that, and make it easy. And then it's up to the community to create an environment where users feel safe and don't want to delete their accounts.

What about letting a user download all their posts before deleting them?

[dessalines]

We have an issue for account data export. It wouldn't be too difficult, but we just have a lot of other priorities: #506

[Nutomic]

Okay in that case I would change it so that content is only deleted if a checkbox is selected. Then you can choose to delete data or keep it. And i would also add a password field for account deletion, so that someone cant delete your account with a stolen login token alone.