Legacy Comments System & Historical User-Generated Content
This Data Protection Impact Assessment (DPIA) evaluates the data processing activities associated with Aevum News's legacy commenting infrastructure. The system historically allowed readers to post, edit, and reply to comments on news articles. Following a platform migration in Q3 2024, the legacy system has been decommissioned, and all associated data has been archived. This assessment outlines the lawful basis, data flows, risk analysis, and mitigation measures applied during the archival and decommissioning process.
The legacy comments system operated from 2019 to October 2024. It collected user identifiers, email addresses (for moderation alerts), IP addresses, comment content, timestamps, and moderation flags. The system is now read-only and archived for legal, historical, and audit purposes.
| Data Category | Specific Fields | Lawful Basis (GDPR Art. 6) |
|---|---|---|
| Identity & Contact | Display name, email address (hashed for alerts) | Legitimate Interest (1f), Consent (1a) |
| Technical & Operational | IP address (anonymized post-90 days), User-Agent, timestamps | Legitimate Interest (1f) |
| Content & Behavior | Comment text, reply threads, moderation actions, edit history | Legitimate Interest (1f) |
| Risk Scenario | Likelihood | Impact | Risk Level | Mitigation Applied |
|---|---|---|---|---|
| Unauthorized access to archived comments | Low | High | Medium | Encrypted at rest (AES-256), strict RBAC, quarterly access audits |
| Re-identification of anonymized IPs | Low | Medium | Low | IPs truncated after 90 days; hashing with rotation salts |
| Retention exceeding legal necessity | Medium | Medium | Medium | Automated deletion policy enforced at 7 years; DPO review annually |
| GDPR Article 17 (Right to Erasure) conflicts | Medium | High | High | Redaction workflow implemented; legal override documented per Art. 17(3) |
All legacy comment data is retained for a maximum of 7 years from the date of archival, aligning with statutory limitation periods for media disputes and copyright claims. After this period, data undergoes cryptographic erasure using NIST SP 800-88 Rev. 1 compliant wiping procedures. Exceptional retention beyond 7 years requires written DPO approval and is logged in the central retention register.
Individuals retain the right to access, rectify, or request redaction of their comments. Due to journalistic and historical exemptions, full erasure may be partially restricted under GDPR Article 85 and national media exceptions. Requests are processed within 30 days via privacy@aevumnews.com.
This DPIA has been reviewed and approved by the Aevum News Data Protection Officer and Legal Compliance Committee. Questions, rights requests, or compliance inquiries should be directed to: