search

miwarnec / uMMORPG

4 stars 0 forks source link

Cannot delete account #41

Closed wovencode closed 4 years ago

wovencode commented 4 years ago

Versions (please complete the following information)

Describe the bug After creating an account, is it not possible to delete that account afterwards anymore.

This is very cumbersome for the admin to manage all deletion requests manually, especially if tons of accounts are getting generated when logging in with a typo (see previous bug report).

Also important is the fact, that a missing delete option is violating the GDPR (General Data Protection Regulation) of the EU that exists since 25th May 2018.

miwarnec commented 4 years ago

https://www.w3schools.com/sql/sql_delete.asp

jonmalave commented 4 years ago

https://www.w3schools.com/sql/sql_delete.asp

This is not a fix... stop being lazy and fix your asset!

did you just totally miss this part

Also important is the fact, that a missing delete option is violating the GDPR (General Data Protection Regulation) of the EU that exists since 25th May 2018

funny enough @wovencode i know where he got this idea from... it was from me! I created something once that did this long time ago as a temporary solution and he used it as a way to generate user account. What a friggin joke...

iamallama commented 4 years ago

@jonmalave Where in the GDPR does it say anything about deleting an account? Because it only mentions deleting personal data and uMMORPG records absolutely zero personal information. So what exactly needs to be deleted?

jonmalave commented 4 years ago

@jonmalave Where in the GDPR does it say anything about deleting an account? Because it only mentions deleting personal data and uMMORPG records absolutely zero personal information. So what exactly needs to be deleted?

Any information relating to a living, identified or identifiable natural person.

This could be directly (e.g. a person’s name) or indirectly (e.g. the owner of that business). The definition of personal data applies to any piece of information which can used to identify an individual, based on ‘all means reasonably likely to be used’.

So for example, a user ID number is classed as personal data, because it can be matched to the name of a user on a database. The term ‘personal data’ still applies to data even if it requires the use of information elsewhere to identify an individual.

Read a bit more on what is considered personal data...

if someone decided to put their "first and last name as their username" then wants a way to delete it, but has zero option to do so... what do you think that's called? a violation of GDPR

Yes, it is the user who decided to put their first and last name as their username, (you have no way of stopping them except for simply never storing any user information in a database period) otherwise when you do provide the option to create an account of any sort, you are creating a liability for yourself to protect that user's data.

iamallama commented 4 years ago

Unfortunately the GDPR doesn't work like that. A name by itself is not considered personally identifying information because there can be multiple people with that same name. A name with other identifying information is, however uMMORPG doesn't record any additional identifying information. The UK’s Information Commissioner's Office specifically states this.

By itself the name John Smith may not always be personal data because there are many individuals with that name. However, where the name is combined with other information (such as an address, a place of work, or a telephone number) this will usually be sufficient to clearly identify one individual