Security and privacy

There is a question around whether or not this is personally identifiable data, if the username (and first/last name?) has already been removed? For instance, I would point out that the webserver logs almost certainly still include a list of IP addresses that have accessed the site, but that wouldn't be considered personal data (or would it?)

I could also imagine good reasons why you might want to store the last IP address that a particular user account used, in order to perform security audits (which might be a required part of due-diligence and keeping the data on the site secure; which is, of itself, a part of the GDPR).

Hello,

The process to exercise the user's right to be forgotten (The user requests to have their personal data deleted) and privacy by design (user information is only kept for as long as it is needed) in Moodle are not done by just going to the user administration screen and deleting them.

A request needs to be be made. This can be done from the user's profile, of if an admin, from the data requests page (Site administration > Users > Privacy and policies > Data requests). The reason for this process is to clean all of the student's data from the site.

Most of the user's information is removed apart from critical information needed to prove in an audit that all data requests were complied with.

The last IP address is not critical and so is deleted.