​
r/BlackPeopleTwitter operates a verification system requiring users to submit photos of their forearm to volunteer moderators to prove their race, in order to access certain threads.
The issues:
- Photos contain racial origin data, special category data under Article 9 UK GDPR
- No privacy notice provided to users, violating Article 5(1)(a) transparency principle
- No identified data controller, violating Article 13 UK GDPR
- No stated retention or deletion policy, violating Article 5(1)(e) storage limitation principle
- No documented lawful basis for processing special category data, violating Article 6 and Article 9 UK GDPR
- Photos uploaded to Imgur, a third party, with no data processing agreement, violating Article 28 UK GDPR
- EXIF metadata in photos could expose users' home addresses without their knowledge
- Moderators are anonymous, unvetted volunteers with no data protection training
When brought up, I was met with mocking and an instant ban.