Should we purge old & unused accounts?

[vinzv]

I just came across this posting over at Bunsenlabs forum which I found interesting. Quoting:

We'll shortly delete all forum accounts that match the following criteria:
We'll delete all accounts which both have zero posts and have not been logged in to after 2021-04-01.

So I poked around the member list on our forum and gathered some figures:

Data

1. We currently have 2.010 activated accounts on this forum.

2. Of them there are...

• 1.620 accounts with 0 posts and older than 1 year
• 900 accounts with 0 posts and no login since 1 year
• 420 accounts with 0 posts older than 1 year with 0 logins
• 1.350 accounts with 0 posts and older than 2 years
• 1.320 accounts with 0 posts and older than 2 years and no login since 2 years

3. Data stored for each account is at least:

• username
• "real" name
• password (hashed)
• email adress (which often reveals their real-real name...)
• IP and hostname of their last visit

4. Furthermore, what's stored more often than I'd had expected:
(I only did some spot checks.)

• location
• sex
• language

Resulting consequences

So all in all that's a relatively huge number of accounts and therefore quite a big set of personal data. With all consequences and liabilities for the siduction core team. Which is also covered in a way by the Bunsenlabs people:

The purpose of this exercise is to get rid of personally identifiable information associated with these dormant accounts such as email addresses and nicknames: Passive readers can always view the boards anonymously without signing up, and the best data protection for user data is simply not having any data on file. Also, if the user is not using the forums (as indicated by the 1+ year absence), we shouldn't continue storing the data as there doesn't seem to be a reason for that anymore (discontinued usage).

While this is all correct, it leaves out data protection laws (GDPR) that demand to store data as short as possible while. Furthermore, it recommends establishing review and deletion processes.

My proposal

So I want - and somehow we have to - do that "data hygiene" over here as well. But I'd like to add some additional steps:

• Remind all users with no login for 6-12 months of their account and ask them to come back. Add a way for them to delete their account rightaway.
• Send out an informational note about anonymous reading possibilities (e.g. RSS feeds) to all accounts inactive/no post >1 year. Add a way for them to delete their account rightaway.
• Send out a reminder to all accounts with no login and no posting for >1 year, that their account will be deleted soon.

Any thoughts on that? Otherwise, I maybe will just go for it... ;-)

[fams]

Just necessary imho (GDPR).
Good plan.

[edlin]

Gute Idee.
Ich würde in der E-Mail eine eindeutige Frist (14 Tage?) setzen, innerhalb derer ruhende Accounts wiederbelebt werden können.
Hinweis, dass die Nutzer nichts unternehmen müssen, wenn man seinen Account inklusive der damit verbundenen Daten verfallen und löschen lassen will. Dies erspart das rücksetzen von Passwörtern (viele werden ihres nicht mehr kennen) und die Fragen, wie und wo man seinen Account löschen kann.

Good idea.
I would set a clear deadline (14 days?) in the email within which dormant accounts can be reanimated.
Note that users do not have to do anything if they want their account, including the associated data, to expire and be deleted. This saves resetting passwords (many will no longer know theirs) and the questions of how and where to delete their account.

edlin

[DeepDayze]

Totally in agreement with this idea as it will reduce the attack surface in case of a breach. Sending out a mass email to those old inactive accounts is one way to make members aware and if they want to keep their account active they should at least log in once each year or if they forgot their password or no longer have access to the email account used at registration there should be instructions (in both English and German).

[vinzv]

Thanks for the input and the affirmation, all. I'll be starting the cleanup process soon.

[vinzv]

Quick update: Currently I'm sending out the initial mail to ~1.700 accounts.

Furthermore, I found a way to automate the whole process. \o/
Once the initial cleaning is done, I will set the forum up in a way that:

• every account not logging in for 6 months will get one reminder
• after that passing 15 days the account will get deleted

All that is done with no interaction, which gives us a valid data handling strategy to comply with GDPR.