GDPR, Boards.ie and You

Boards.ie: Sean

Given that GDPR comes into effect on 25 May we wanted to give you a quick update on how this will impact Boards and our community and what changes we are making to the site and our procedures and processes in order to be compliant with the new regulations.

Policies

We are currently updating our Terms of Use, Privacy Notice and Cookies Policy in light of GDPR. There are some final clarifications that we are awaiting feedback on from our lawyers but we expect the updated policies to be live on the site on 25 May.

Personal Data

Boards processes personal data of its registered users. This applies to anyone who has a Boards account (that has not subsequently been closed). Boards does not process personal data for people who visit the site and have not registered for a Boards account.

Data Access Requests

Under GDPR users have the right to request access to any of their personal data that is held by Boards. In order for Boards to process a data access request from a registered user of the site we need to verify the identity of the person making the request. Therefore, the process for requesting your personal data is as follows:

• For identity verification purposes the data access request must be sent via a Private Message (PM) to the following recipient Boards.ie: GDPR (if for any reason you are unable to access or send a PM please email datarequests@boards.ie and we will get back to you with further instructions).
• Data access requests will only be processed for the user account from which the PM was sent. We will not process data access requests for personal data related to 3rd party accounts
• Once processed, an encrypted zip file containing the personal data will be sent to the email address associated with the user account
• The password required to decrypt the zip file will separately be PM’d to the user making the data access request
• If for any reason you cannot log onto to your Boards account you should follow the standard password reset procedures

We will begin processing data access requests from 25 May onwards and will respond with 30 days.

Account Closure / Erasure of Personal Data

Users have the option to close their Boards account. This option is available in User Control Panel / User Settings. If this option is selected all personal data will be permanently deleted. Your Boards username will be retained but this will not be associated with any other information relating to an identified or identifiable natural person and therefore will no longer be considered personal data.

In specific instances where a person could reasonably or easily be identified from their Boards username we will consider requests to change the username; these will be dealt with on a case-by-case basis.

Should you wish that all your personal data be erased from Boards systems you should choose to close your Boards account.

Inactive Accounts

Under the GDPR principle of not retaining personal data longer than is required we intend to email all inactive users (users who have not logged onto Boards for 6 years or more) to see if they still want to remain a member of Boards. Inactive users will have 30 days to log onto the site. If they do so within the 30 days we will remove them from the inactive user list. If they do not we will assume that they no longer wish to retain their Boards account and we will begin the process of closing their accounts.

User Posts

For users with an active Boards account, posts made by a user can be associated with other information held by Boards that relates to an identified or identifiable natural person (for example a post can be associated with a user’s email address and/or real name). Therefore, posts made by a user with an active Boards account are considered personal data and GDPR regulations apply to these posts, including the right of erasure. As such, from 25 May we will begin to process requests for erasure of posts from users with an active Boards account. These requests must be sent via a Private Message (PM) to the following recipient Boards.ie: GDPR (if for any reason you are unable to access or send a PM please email datarequests@boards.ie and we will get back to you with further instructions).

For closed accounts all personal data (other than users’ posts) will be deleted. Therefore, posts made by users whose accounts were subsequently closed cannot be associated with other information held by Boards that relates to an identified or identifiable natural person and as such are not considered personal data and GDPR does not apply to this data.

In specific instances where the content of a post contains sensitive data or data that could be used to identify an individual we will consider requests to edit or delete the post; these will be dealt with on a case-by-case basis.