As I write this I literally have a script ( https://github.com/j0be/PowerDeleteSuite ) running deleting all posts and comments I made so I can delete my accounts and leave them with nothing. The last couple of days they have been prompting people to provide identification documents to access their accounts. This is going to start becoming more prevalent on platforms. I always hated the site but that’s crossed the line for me. So purpose of this post is just to give people a heads up while they still have access if they want to remove their data and / or delete the peice of shit from their life once and for all.
That’s illegal under GDPR, if true
If you have tangible evidence of this claim, please document it online and report it to the government
This statement is unfortunately doing a lot of work with the word “that”, even if I dearly wish it wasn’t so. Like, I really wish it were that easy, it would even the playing field back to the non-corporate webmaster almost instantly.
But alas.
The GDPR doesn’t have some special category where data only becomes data once you hit Submit. Article 4 literally defines “processing” to include collection, recording, and storage. So yes, depending on what the site is actually doing, it can absolutely be processing what you type before you submit anything:
https://eur-lex.europa.eu/eli/reg/2016/679/art_4/oj/eng
But that does not get you from “they captured it” to “therefore illegal.” GDPR doesn’t prohibit processing personal data; it regulates how and why you can do it. Article 6 gives six possible lawful bases for processing, including consent, contractual necessity, and legitimate interests (and it is bastardizing the spirit of how these six interconnect that these companies use to skirt intent of the law):
https://eur-lex.europa.eu/eli/reg/2016/679/art_6/oj/eng
The actually interesting question is what they’re capturing, why, how long they retain it, what they do with it, whether they disclosed that processing, and what lawful basis they’re claiming.
That’s where you can potentially have a GDPR problem.
Article 5 requires, among other things, fairness/transparency, purpose limitation, data minimization, limited retention, and appropriate security:
https://eur-lex.europa.eu/eli/reg/2016/679/art_5/oj/eng
And Article 13 requires the relevant information to be provided when the personal data is obtained. There isn’t a magical “well technically the user never clicked Submit” exemption from transparency:
https://eur-lex.europa.eu/eli/reg/2016/679/art_13/oj/eng
There’s also a separate ePrivacy issue if we’re talking about storing or accessing information on the user’s device. Article 5(3) generally requires consent unless the storage/access is strictly necessary to provide a service the user explicitly requested:
https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A62017CJ0673
And this is where the details get important again, because regulators have explicitly recognized things like short-lived, first-party “user-input” session cookies for multi-page forms as potentially falling within that necessary-function exemption. See WP29 Opinion 04/2012:
https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf
That is a very different animal from silently retaining abandoned form contents indefinitely, sending them somewhere unexpected, profiling somebody with them, or reusing them for advertising.
So if somebody actually wants to know whether their abandoned input was retained and what happened to it, GDPR gives them tools for finding out instead of having to speculate from browser behavior. Make an access request to the controller and ask what personal data they hold, the purposes/legal basis, recipients, retention period, and the source/context of the collection.
They normally have one month to respond under Article 12:
https://eur-lex.europa.eu/eli/reg/2016/679/art_12/oj/eng
If they don’t respond, or the answer establishes something questionable, then you have something concrete to take to the relevant supervisory authority under Article 77:
https://eur-lex.europa.eu/eli/reg/2016/679/art_77/oj/eng
The EDPB has the list of national authorities here:
https://www.edpb.europa.eu/contact_en
GDPR is leverage, not a magical force field that prevents a server from receiving bytes. The useful part is that it gives you a mechanism to make the controller explain what those bytes became, why they kept them, and what they did with them—and a regulator to complain to if the answers suck.