Helper's refresh session: Right to be forgotten

h_henna

Hey Folks,

We have seen that some topics in our help and support channel are quite complex to fully understand and seem to cause some confusion. So, we put our heads together and thought hey, wouldn't it be great to properly dive into these grey areas to make sure our helpers have all the info they need to provide the best advice?

As a result, we decided to create the Helper's refresh sessions: Threads focused on different subjects which helpers can visit to refresh their knowledge or ask questions to better understand the processes behind some of our more complicated topics.

This week's topic is Right To Be Forgotten so let's begin:

What does this legally mean?

The right to be forgotten is also known as the right to erasure. It gives members the right to request the erasure of their personal data under data protection law.

It is not an absolute right and giffgaff may continue to hold certain personal data where there is a continued use justification. This can be to meet legal obligations required of us and/or for legitimate business reasons (i.e we cannot erase your data in all cases if you are still partaking of giffgaff products and services).

What does it do?

At giffgaff there are two aspects that will come into play when we act upon a Right to be forgotten request:

The information we hold on the member in our systems will be erased if there is no longer a need for it (or parts of it) to be kept. The amount of posts linked to a member's account on the community platform. If there is a considerable amount, it is more likely that this account will be anonymised and therefore no longer linked to the member.

Note: There is a separate procedure for members would like to simply close their account or would like to stop receiving emails.

Who to contact?

Members should contact the Agents (see the Step by Step guide below) to submit a Right to be forgotten request.

How long do giffgaff have to respond?

giffgaff have one month to respond to Right To Be Forgotten requests unless the request is complex in which case this can be extended by a further two months but we will always let the member know. giffgaff may be unable to meet a request for erasure if the request is deemed excessive.

Step-by-step guide on how to do this?

1. Load giffgaff.com

2. From the nav, hover over help and use the 'Ask a giffgaff Agent' Link: giffgaff.com/app/ask

3. Click the 'show more' link

4. Click the GDPR Rights box

5.Click 'Right to get your data deleted' box

6. Click the 'No, I still need help' button

7. Fill out the form and submit it

8. An agent will respond and ask the member to prove identity and account ownership

Here is the direct Agent Link: https://support2.giffgaff.com/app/ask/GDPR-Rights-%28General-Data-Protection-Regulation%29/Right-to-get-your-data-deleted/form/

tradertall

thank you. this law is important.

giffgaff20147

@h_henna

Thanks for information on this subject

persco

@h_henna Thanks. Not many requests like these about but helpful to know. As members get to know more about GDPR am sure requests may come in.

Do members get to know which info are refused for erasure?

k89bpa

I'm sorry but people need to be aware of much more than that.

They need to be aware that accepting the offer of "anonymisation" will make it a lot more difficult to take their case further externally.

They need to be aware that accepting the offer of "anonymisation" will NOT stop people from being able to find them and identify them from their content, (that their content WILL haunt them forever basically if they take this option in many cases).

They need to be aware that accepting an offer of "anonymisation" MAY make it much more difficult to assert their rights as owners and creators of the content which they have submitted unless despite the anonymisation it is still possible to link a poster with their content.

Most people are probably oblivious to the fact that they own the copyright to all the ORIGINAL content they submit for instance and that this affords them many rights over the content and to break the link between a physical account and their content will make such rights much more difficult to prove and utilize.

Finally they need to be aware of what would be required technically for a "Right to be Forgotten" request to be granted in terms of their forum posts, (it's one database query being run - I've done so as administrator of other softwares for people who had over 100,000 submissions long before GDPR became a thing - it takes a few minutes to complete).

I'm not trying to start anything or stir anything but we should be HONEST and TRANSPARENT with people about this stuff, especially here where many seem to be totally oblivious to how the internet works let alone the more technical side of the whole thing, (including the legal stuff regarding ownership of content).

They need to be made aware of this stuff, and maybe more that I haven't even thought of to enable them to be able to make an INFORMED decision and provide INFORMED consent when deciding how to progress their issues, whether it's on this or any other matter. There was a post earlier today that I saw about statutory rights regarding purchases were the poster at first seemed unaware of their rights - this honesty and transparency is equally applicable to cases like that, (to be fair there is probably a post somewhere on the forum about statutory rights but good luck finding it).

k89bpa

We should also be making clear that some information HAS to be stored for a set period of time regardless of GDPR, like financial information, (six years), communications and internet metadata, (one or two years, I forget), because there are a whole raft of laws which prohibit a company from erasing everything immediately.

AND that in some cases death changes the situation, (in case it's someone wishing to act on behalf of a deceased loved one).

I actually sent an email touching on this area very loosely the other day...

A lot of this GDPR stuff could probably be made a lot less important/necessary, if people were made much more aware of the unspoken data retention policies and attitudes of the company, but more importantly if people were made more aware, (or aware in the first place), of how many people posting have already given away more than enough information for miscreants to cause them some genuine harm in their real lives should a miscreant be minded to do so.

There is a crazy amount of personally identifiable material being posted and shared without any restriction whatsoever to the world and his dog.

And many doing the sharing are kids.

Tackle that and I'm guessing the necessity for people to pursue GDPR complaints would be slashed significantly.

bill48er

Hi @h_henna

It's good to see this sort of information being crystalised in to a single post (even if it needs to go a bit deeper as @k89bpa suggests).

However, posts like this very quickly get lost in a never ending influx of new postings, a sticky is one answer, but be honest, how many of us ready stickies.

So, my suggestion is that expanplanations/clarafications such as this, really need adding the the new "go faster" KnowledgeBase

shabazmoqsud

# @h_henna this is great and much need

Glad giffgaff are implementing this

kath72

I think it’s important that an account can be removed, not just left forever.

In fact I suspect my son will be making use of this option now that he is on another network !

roxy_r

Morning folks,

There are loads of things that can be discussed and debated when it comes to this right because there are so many variables and possibilities with every request. It is a very complex topic and we saw that there is a need for our helpers to be able to understand the basics which is what this thread is all about.

It is important to keep it simple here so we give our helpers the sufficient knowledge to advise on when it is needed to raise a Right to be forgotten request and when it is not and how long would they have to wait to get a reply. When it comes to the details, the best thing is to point the member towards the conversations they are(or will) have with us when raising the request.

One of the main things that prompted us to post this thread is the fact that some members thought this process is used either for closing down an account or stop receiving emails from us and we wanted to make it clear that this is not the right way to achieve either of those things as some of you might already know.

If we need more info on the KB, that can be put forward to the KB editors group and if there is a need for a deeper conversation, can we please have that separately? Otherwise I am afraid that this thread will not achieve its goal.

Cheers everyone,

Roxy

k89bpa

@roxy_r if that's the case then maybe the "helpers" should not be commenting at all about this aspect of GDPR because of the possible implications and should instead direct those types of user cases to the information relevant to those user cases because as you rightly say, they're nothing to do with this specific part of the GDPR and DPA.

For those user cases even mentioning GDPR will serve only to confuse the issue will it not?

They certainly should not be advising anonymisation because of the possible copyright implications.

roxy_r

Morning @k89bpa,

It is this part of your post we are trying to address: 'direct those types of user cases to the information relevant to those user cases' as we have seen that not everyone knows when it is appropriate to advise on this right. It is not a surprise as this is a complicated topic so we have tried to give a brief overview for helpers to understand in broad terms what it is all about and therefore be able to suggest the right path that the member needs to follow depending on what they want to achieve.

k89bpa

I understand @roxy_r, however I think a more appropriate approach would be to advise helpers of what to do in such user cases rather than potentially further muddy the waters by talking about GDPR.

For instance, the stopping of emails, GDPR shouldn't even be mentioned, rather people should be directed to the appropriate settings pages, (with a direct link to those sections), rather than have people start talking GDPR to them.

The same is true to a degree with regards "closing an account", they should be advised to remove all payment authorization and that this will make their account dormant, (this is all that happens whenever you close any kind of account with any company because of the various data retention pieces of legislation).

One could further advise, "We will keep ... information for ... because ...", for information which various pieces of legislation mandate certain data retention, but again, mentioning GDPR would be misleading and muddy the waters somewhat.

As a customer, if I was in either of those two user case scenarios and someone started blathering about GDPR I'd be rather perturbed by their lack of knowledge and understanding, whereas if I was faced with someone describing the actual processes in place and/or referencing appropriate legislation it would inspire a lot more confidence and trust.

EDIT: Sorry that's somewhat muddy too.

If I was to work in a support giving role for a company what I would want from them is to tell me, "If customer wants x then y", which isn't what this thread is doing in the user cases specified.

This thread tells people what not to do in such cases without telling them what they should be doing, which would leave me personally having to choose between using my common sense and actually advising the customer appropriately, (possibly risking termination for doing so), or following the company line however inappropriate it is for the user case scenario.

In terms of specific advice regarding GDPR related queries, where GDPR is actually relevant because in many cases it just won't be, that needs to be handled very differently. What the "helpers" need to know is the user scenarios where GDPR is and isn't relevant to the query to which they are responding to.

roxy_r

A Do's and Don't's section is a great idea! thanks for suggesting that 🙂 We will see how we can improve the Refresh sessions to make sure everyone gets the most out of them.

chand311

Thanks @h_henna for sharing this important information.

koshka

How many posts is " too many to erase" ?

k89bpa

@koshka I can answer from a technical standpoint, there is no maximum.

As I said, I used to be an admin, I used to delete user data upon request because I felt it was the right and decent thing to do, plus it only took me a few minutes to do so at most.

From a technical standpoint it is not a difficult or time consuming job and the process is identical whether it's ten posts or over a hundred thousand being removed.

And I was doing it the complicated way, working directly on the database, (I was always more comfortable working directly on the database than using the admin panels/tools provided), many forum softwares allow you to do it much more simply than that...

https://www.simplemachines.org/community/index.php?topic=314058.0

...and so on.

From a non-technical standpoint it's an interesting question.

stephi12

THANK YOU

carogix

indeed, timely!

clikasarus

@h_henna Thanks great to know for anybody who wishes to leave and will be very helpful for members who give help