5 ms·

I suggest you read about the new European General Data Privacy Regulation, which comes into force in May 2018, and requires you to allow users to (a) export and

I suggest you read about the new European General Data Privacy Regulation, which comes into force in May 2018, and requires you to allow users to (a) export and (b) delete all personal data they gave you, including messages, posts, etc. Violation will be punished with a fine of up to 20 Million EUR or 4% your global revenue, whichever is higher. This law will apply to all sites that have EU customers, no matter where the site is located, and will be enforced globally (through banks assisting with account freezes, etc).

shandor 9y ago
Where did you get that "messages and posts" are included in data that falls under the regulation? Not contesting, genuinely interested. I was under the impression it only covered personal data in a very strict sense (names, addresses, personal info like gender, etc)
- kuschku 9y ago
  The GDPR, as far as I was told when asking a lawyer, covers anything that could contain personal information. If a user chooses to put their SSN into an HN post, then that post is now also personal data. Or their address. Or if they write in a post that their parent has a specific kind of cancer. Unless you can guarantee that no post contains such data, you should assume them to be personal. And no ToS rule "don't post personal data" will protect you.
Pistos2 9y ago
Delete, or make it not findable by other normal user accounts? How is deletion enforcable or provable? Are government agents allowed to enter your premises or those of your data centre(s), and gain complete and unrestricted access to all physical disk media to do a full scan to prove or disprove any given allegation of failure to delete?
- kuschku 9y ago
  There are no government agents entering your premises, but if it turns out you had the data still (and even if it's an employee telling the police), you're on the hook for up to 4% global revenue for the time frame in which you did it, or 20 million EUR, whichever is higher. So you absolutely don't want to do that. Google handles this by, over the course of a few weeks, even deleting all traces from its backups and caches.

shandor 9y ago

Where did you get that "messages and posts" are included in data that falls under the regulation? Not contesting, genuinely interested. I was under the impression it only covered personal data in a very strict sense (names, addresses, personal info like gender, etc)

kuschku 9y ago
The GDPR, as far as I was told when asking a lawyer, covers anything that could contain personal information. If a user chooses to put their SSN into an HN post, then that post is now also personal data. Or their address. Or if they write in a post that their parent has a specific kind of cancer. Unless you can guarantee that no post contains such data, you should assume them to be personal. And no ToS rule "don't post personal data" will protect you.

Pistos2 9y ago

Delete, or make it not findable by other normal user accounts? How is deletion enforcable or provable? Are government agents allowed to enter your premises or those of your data centre(s), and gain complete and unrestricted access to all physical disk media to do a full scan to prove or disprove any given allegation of failure to delete?

kuschku 9y ago
There are no government agents entering your premises, but if it turns out you had the data still (and even if it's an employee telling the police), you're on the hook for up to 4% global revenue for the time frame in which you did it, or 20 million EUR, whichever is higher. So you absolutely don't want to do that. Google handles this by, over the course of a few weeks, even deleting all traces from its backups and caches.