Mattermost-server: Properly delete an user from the server

[mthld]

Summary

Actually a user account cannot be deleted.

Steps to reproduce

Create a user, try to delete it, you can't.

Expected behavior

It must be possible to completely delete an user from a Mattermost server.

Observed behavior (that appears unintentional)

It's very confusing to search between the numerous settings parameters, dark and complicated menus for the option and not finding anything.

Actually a user must go through "hamburger" main menu, account settings, advanced and deactivate account to finally discover they can't really delete their account.

Possible fixes

Users must be able to delete completely their account and an admin should be able to do the same.

[mthld]

After some research I find it possible to do so through the command line tool: https://docs.mattermost.com/administration/command-line-tools.html

But obviously users & Mattermost admins don't have access to the server console, so it doesn't solve anything.

[amyblais]

@mthld The cli command that you posted above is the way to go if you want to permanently delete a user.

For any improvement suggestions, you can open an issue on our feature request forum here https://mattermost.uservoice.com/forums/306457-general.

[mthld]

@mthld The cli command that you posted above is the way to go if you want to permanently delete a user.

For any improvement suggestions, you can open an issue on our feature request forum here https://mattermost.uservoice.com/forums/306457-general.

Hi, I disagree on the "feature" definition, it's definitely a bug. The EU laws would say the same.
However I'll cast a vote on this third-party website, the bug is #1, hope it'll be resolved soon.

[amyblais]

A response from our Product Managers after reviewing https://gdpr-info.eu/art-17-gdpr/:

There is no indication that any functionality must be given to the user to delete their own account. As the controller of the data, the organization is responsible for complying to the user's requests to be erased. Our CLI command is the method for which users can be deleted by the admin of the organization. This action was designed to be permissible by the admin to protect the data integrity of the system.

Thank you for bringing this up and for upvoting a feature request!

[amyblais]

Closing as there hasn't been feedback on this for a while. I hope you will open a feature request for this,

[mthld]

@amyblais there is one actually: https://mattermost.uservoice.com/forums/306457-general/suggestions/39446377-users-should-be-able-to-delete-their-datas-without

[vszakats]

Quite a let-down reading the response to this.

While the GDPR doesn't specify that there must exist a self-service delete button, any alternate solution for online systems with a account/login mechanism will make the deletion process cumbersome and unverifiable with regards to user experience and GDPR compliance.

I.e. if the user doesn't have the option to login and erase the account themself, they

1. need to look up and find the hosts privacy policy,
2. which may or may not include details on how to excercise the deletion rights,
3. which may or may not point to a way to contact the host/admin/DPO/customer service.
4. then they need to disclose personal data (PII) when contacting the host for identification,
5. which may involve email (with all its privacy pitfalls), or a 3rd-party CS/ticketing service with further pitfalls, or some other channel outside the hosted Mattermost app.
6. then blindly wait for a response which may or may not come.
7. in the lucky case when an admin picks up the deletion request, they not only need to deal with deleting the Mattermost account itself using the CLI command, but also with:
   
   
   
   • identifying said user
   
   
   • verifying their authenticity
   
   
   • then cleaning up all the PII that got collected in the ticketing/email/etc systems.
   
   

This to me seems like a hugely more frustrating, time-consuming and error-prone process with multiple chances of leaking the data to be deleted to all sorts of new places and involving admin/customer-service staff in handling the PII about to be deleted. Consequently, I doubt such process would pass a GDPR muster test. Notice that in practice such process may take multiple months to complete.

Compare this to the self-service method, which can be completed in seconds or a few minutes:

• Login as normal
• Find and press the 'Delete my account' button on the UI
• Confirm (optional)
• Done.

All the while no 3rd party person or system was involved in the process, and no additional PII had to be used or supplied.

Hoping this can be re-opened and re-considered for a user-friendly implementation.

(and now I'm out finding out how to delete my account from the Mattermost demo server...)