Private Deleted Messages from 10 years ago have reappeared

Well I see it is hosted in Canada, as detailed here https://www.boards.ie/discussion/2058200779/gdpr-boards-ie-and-vanilla-how-does-this-work. Let's be clear though, from my experience with GDPR requests, and I've handled a few (in my own domain). There isn't clear info about what exactly constitutes "necessary" data, especially when the user generates that content themselves. You can go nuclear option too, I generally execute Right to be Forgotten requests by scrubbing everything entirely from the site, including the user themselves and their sessions.

One important thing from the linked thread though, a user requested to be deleted, and they do NOT have to use a dedicated email to request deletion, the forum is good enough! Any avenue of contact with staff is permitted.

You can also copy and paste parts of the PM i.e.: Quotes, and format them as part of your new message, so who owns that?

This is actually unsurprisingly like email in that email systems typically don't duplicate messages within their database.

If I send a message to someone else within my organisation, the system stores one copy of that email with a pointer from both mailboxes to that message. It's a storage efficiency thing. When you "delete" the email, you just delete the pointer. The actual data is only purged when it has no more pointers to it.

So it makes sense that vBulletin would have done the same thing.

What was obviously not intentional is that the migration would resurrect these into some pseudo-thread format. In a way it's good that this has occurred, as otherwise this would never have been spotted - there has been an oversight in offboarding the TalkTo forums where the content of the accounts should have been purged after a set amount of time. Whether it's incumbent on boards or on the third party to do this, is up in the air. The account is still technically open and available to that 3rd party.

Not a major issue, but as @McBain11 says the safest way forward might be to purge all PMs of select accounts, like retired TalkTo forums, closed accounts, etc, and put out a sitewide warning that this is going to occur.

If it is not going to be possible at all for users to delete their own messages, then the system should automatically prune/delete them after a fixed period of time.

Based on this I just went back to see if I could access an old closed account. I have two. One from many years ago. Both account names are active when you attempt to log in but the password doesn’t work. Obviously that’s a good thing. However how does that work, I assumed my PM data would have been deleted when the account was closed but now I don’t trust that it was. There is more than enough across both accounts PMs to clearly identify me and I assumed that data was scrubbed.

How do I find out if it was? Should I have put in a GDPR request to be forgotten instead?

Hi Niamh, what about threads that were deleted at request? These are back also.

These are not emails where the information in both inboxes is stored on separate systems. All of this information is under the control of boards.ie. There are a couple of issues that i can see

PMs were only being soft deleted.

When a talk to forum was shut down the PMs of the Talk To users were not deleted.

This seems more am issue with the pm system before the migration that has just come to light because of the migration.

It makes sense that if deleted from your sent box it would still be in the other inbox.

The issue is the talk to companies should have purged their data on a regular basis. And definitely when closing up shop they should have. Boards probably should have done it anyway but I see the companies having more responsibility to delete or make sure/confirm when they close their account it would be deleted.