14

This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.

I will explain the best I can:

I'm a creative professional and frequent a forum dedicated to my industry. On the forum I have 2 accounts — one 'official' account under the name of my company, used to make official announcements etc, and a personal account under an anonymous username.

On the forum I had a discussion about a competitor company and made some personal comments about what I think about them. It's a small industry and the competitor company is very influential, so I wanted to keep these comments separate from my official company account and posted them from my anonymous personal account.

Weirdly (and this is what seems questionable to me) the forum owner has figured out that my personal account is linked to my professional account since they share an IP address, and has shared this info with my competitor. (As far as I know the competitor has a relationship with the forum owner because they advertise there regularly.)

Now my competitor knows that the anonymous account belongs to my company and can see my posts about them. The whole thing has caused a stir for me professionally since they are interpreting these comments as the official views of my company.

It seems like some law must have been breached during the sharing of this information? Does anyone have any insight?

I don't necessarily even want to do anything about this, but am just interested in the legality around it.

Ryan M
  • 10,374
  • 2
  • 47
  • 63
Michael Morgan
  • 151
  • 1
  • 6

2 Answers2

15

It seems like some law must have been breached during the sharing of this information?

Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR:

The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected.

If the website terms which you agreed to don't include this data matching, then that processing is not lawful.

The rest of Recital 50 is relevant and worth quoting in full:

If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations.

It seems to me that an anonymous account could reasonably expect that the "further processing" of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website.

Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.

Andrew Leach
  • 1,514
  • 10
  • 15
10

It seems like some law must have been breached during the sharing of this information?

No. A scrutiny of your pseudonymous account would reveal that you used it for advancing your own business interests. That use forfeits the protections for which the GDPR was intended.

The Terms of Use very likely contain a provision to the effect of disclosing account details in the event of suspicious activity. A user's handling (like the one you describe) of two or more accounts in a forum tends to strengthen suspicions of misuse.

Article 6.1(c) of the GDPR also refers to processing (such as disclosure) pursuant to a controller's legal obligations. Although seemingly premature, it is possible that your competitor might have filed suit already (for instance, if your posts are false and/or egregious), in which case the forum/controller has no option but to comply with his requests for disclosure.

Iñaki Viggers
  • 45,677
  • 4
  • 72
  • 96