[openstreetmap/openstreetmap-website] User account self-deletion allows bad actors to delete and recreate the same account name to "lose" changeset discussion and block history (Issue #4018)

[Mateusz Konieczny]

As I understand (see https://ico.org.uk/for-the-public/your-right-to-get-your-data-deleted/ https://gdpr.eu/right-to-be-forgotten/ https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr ) there is no universal method/rule.

We are - as far as I know, I am not a lawyer etc - not obligated to provide self-deletion button at all. We can also provide it allowing deletion at will (used primarily by vandals nowadays). We could also provide one that works only on odd-numbered days. Or only for people who have not edited for a long time.

Account-self deletion seems to exist to cut down on manually processed requests arriving via weird methods and exists for convenience ours and legitimate users.

Main risk is that we could start getting more paper/mail based account deletion requests, but this seems better and less taxing than rampant abuse by vandals.

Warning: I am not a lawyer, this is not official statement of anyone.

BTW, https://github.com/openstreetmap/openstreetmap-website/pull/3398#issuecomment-995018261 has

> > Did you by chance implement some grace period of 14 days, for people who regret their decision after a few days?

> I'd forgotten about that idea of a grace period! It's something that I could add though.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/4018#issuecomment-1776031970
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/issues/4018/1776031970 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20231023/d6554ad8/attachment.htm>