Boards.ie Stats - January 2022

All - as posted perviously we sought advice on this matter. The outcome of that is that they agree with our position - ie this is not a GDPR breach. There was a detailed review and reply sent through from a specialist GDPR law practitioner.

Background:

In January 2022, Boards.ie began sharing certain site usage KPI’s to demonstrate to users the level of traffic on, and contribution to, the forum, and growth of users since the recent platform migration. As part of the KPI’s, Boards.ie compiled a list of Top 10 contributors for that month (i.e. the List).

An issue was raised by a user regarding ones appearance on the List suggesting that the creation of the List amounted to a breach of GDPR (data protection) rights because:

• They had not consented to appearing on such a list.
• The information necessary to compile the List would otherwise be a difficult undertaking for another individual or entity to assemble and, whilst the processing carried out by Boards.ie to create the List was on publicly available data, it still amounted to a breach of users ‘GDPR’ rights as users identified on the List might not welcome attention drawn to the fact of their appearance on it from spouse, family members, or work colleagues.

The right to how Boards.ie processes data is contained in the Terms of Service and Privacy Notice. The Terms of Service that all registered users must sign up to clearly states that “..by posting any Material on or through Boards.ie you grant Boards Software Limited a limited licence to use, modify, publicly perform, publicly display, reproduce, and distribute such Material”. The Privacy Notice also states that “we will keep a record of your posting history” and that “we collect information which you post on Boards.ie and information relating to your use of Boards generally”. This explains to users that that postings by users will be counted, and those postings may be re-used and publicly displayed by Boards.ie in providing its service.

In saying that, we believe that the language in the Privacy Notice could be a little clearer in that regard and should be amended accordingly for the avoidance of doubt which we will undertake.

Considering Article 6 of the GDPR and the question of whether the processing of the data (counting users’ posts and displaying the number of posts) is justified and reasonable. This is known as the legal basis for the processing. Article 6 of the GDPR sets out the legal bases which includes, amongst others, (i) processing necessary for the performance of a contract to which the data subject is party and (ii) processing necessary for the legitimate purposes pursued by the data controller except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data. Both these legal bases are stated in the Privacy Notice, as well as compliance with legal obligations. Of these bases, we believe the legitimate interest basis is most relevant.

Counting posts and publishing the number, date and times of posts serves a purpose (legitimate interest). It enhances the users experience and lends a certain credence and gravitas to users. It creates a hierarchical structure within users. It has minimal impact on privacy, as users use and are encouraged to use pseudo anonymous handles, and it is a common feature of online discussion forum. It encourages use of the forum and generates greater traffic.

The question then becomes whether the data subject could reasonably expect their personal data to be used in this manner. As stated above, users of online forum reasonably expect there to be publicly displayed analytics regarding their postings such as the number, date and time of their posts, as well as the history of posts made by the user. We are not aware if such Top 10 user Lists are commonly used on other forums but in this instance it is just presenting analytics already displayed in a more modular form. This may be novel but it is a reasonably expected use of the analytics in the context of the users relationship with Boards.ie.

Now the balancing test must be applied - does the interests, rights and fundamental freedoms of the data subjects (users) override the legitimate interests of Boards.ie to process the personal data so. The user in this instance cite concerns about spouses, work colleagues and family members noting the intense level of posting which would not be otherwise discernible. Presumably, they fear that such focused analytics exposes them to criticism and potential damage to relationships as a result – it is a privacy concern.

A common-sense approach must be taken and context is important. Our belief is that the list in this instance did not cause unjustified harm to a user, especially where the overall history of the user is already on public display. In the main, identification as a top poster would normally be seen as a badge of honour and a goal to be achieved within the context of users of the forum. Privacy concerns have already been addressed somewhat by encouraging users to use pseudo anonymous usernames. Spouse, family member or work colleague would have to know the user’s pseudo anonymous handle, which could only be provided by the user. Also, the List only appears on a particular ‘Stats’ thread, which the spouse, family member or work colleague would have to locate. Notwithstanding the need for the spouse etc to know the true identity of the user and find that particular thread, a general guide to the level of posting by a user could also be achieved by just periodically checking the user’s profile from time to time to see by how much his total posting since registration has increased during that period. Therefore, the issue which is really of most concern to the user in this instance is identification as a top poster compared to other users.

We believe that the main damage to such relationships (spouse, family member, work colleague) is caused by the general level of monthly posting, which which could be discerned easily through periodic checking of the user profile. To be damaging, the level of posting would have to be ‘unreasonable’ and what is a ‘reasonable’ level of posting can only be determined by comparing the activity of the user to a non-user, rather than other users. Therefore, it is our view that the privacy concern raised is somewhat misplaced and that recognition as a top poster compared to other users on the Site is somewhat irrelevant. 

In conclusion:

We do not consider the use of the Top Ten Monthly Posters List to be in breach of the GDPR or Data Protection Law.

However, our Privacy Policy could be a little clearer regarding such use of personal data which we will update.

For now unfortunately we will not be publishing any further statistics about Boards.ie publicly - including the top ten list. While there is no breach per above - our focus is trying to keep Boards.ie alive which needs all of our attention ... especially financially.