4 ms·

I'm not a lawyer either, but have been going through the GDPR process at my job. It doesn't matter if you operate or are established in the EU. If you have EU v

I'm not a lawyer either, but have been going through the GDPR process at my job. It doesn't matter if you operate or are established in the EU. If you have EU visitors/users they gain the protections of the GDPR and you have to comply. GDPR affects any org/site that collects personal or sensitive data. Amongst many others IP address and email address are considered PII under GDPR. We use IP address for some high level geolocation data and decided to drop the last octet so it's not tied directly to an individual visitor. The specialists we spoke with had concerns about free form input fields because anyone can write anything they want in them. In the case of hackernews it seems like email address, ip, profiles, and comments could contain personally identifiable data. I'm also curious how HN similar sites are supposed to comply with GDPR removal requests when it can destroy the usability and functionality of the site.

brightball 9y ago
I'm very interested to see how such requests would actually work...mainly because I'm curious to see what actual authority the EU has to enforce its laws outside of its borders. I understand it applying to companies that are doing business in Europe but beyond that...?
- ryanlol 9y ago
  There's a plenty of measures the EU could take within it's jurisdiction to enforce it's laws around the world. It might suck if the EU started blocking payments to you.
  - deleted 9y ago
    [deleted]
DoreenMichele 9y ago
In the case of hackernews it seems like email address, ip, profiles, and comments could contain personally identifiable data. You aren't required to put anything in the profile. If you choose to put information in the profile, you can remove it yourself at any time you so choose.
- gregmac 9y ago
  The GDPR also requires personal information be removed from backups, or at least after a backup is restored (eg: restoring from backup does not negate the original Right To Be Forgotten request). So while you can remove some of that info yourself, I don't think that can be seen as fulfilling GDPR requirements. Disclaimer: I am neither a lawyer nor GDPR expert.

brightball 9y ago

I'm very interested to see how such requests would actually work...mainly because I'm curious to see what actual authority the EU has to enforce its laws outside of its borders. I understand it applying to companies that are doing business in Europe but beyond that...?

ryanlol 9y ago
There's a plenty of measures the EU could take within it's jurisdiction to enforce it's laws around the world. It might suck if the EU started blocking payments to you.
- deleted 9y ago
  [deleted]

DoreenMichele 9y ago

In the case of hackernews it seems like email address, ip, profiles, and comments could contain personally identifiable data. You aren't required to put anything in the profile. If you choose to put information in the profile, you can remove it yourself at any time you so choose.

gregmac 9y ago
The GDPR also requires personal information be removed from backups, or at least after a backup is restored (eg: restoring from backup does not negate the original Right To Be Forgotten request). So while you can remove some of that info yourself, I don't think that can be seen as fulfilling GDPR requirements. Disclaimer: I am neither a lawyer nor GDPR expert.