"You're banned!", but we can't tell anyone about it...

We got this letter from the Data Protection Commission a few days ago; apart from us not having a privacy statement visible (it's now here), there is this silly issue of us not being able to tag users publicly as being banned. Still, it's the first time in 10 years that we've had such a complaint...