3 ms·

Most on HN do not appreciate the complexity of this -- perhaps more will after they are asked to implement it (or after they've implemented it and then found th

Most on HN do not appreciate the complexity of this -- perhaps more will after they are asked to implement it (or after they've implemented it and then found their implementation was wholly unsatisfactory after an unlucky legal investigation into the company). Dealing with backups is a significant expense, but dealing with data on a person that they themselves did not put on the platform is a much larger can of worms which makes it effectively impossible. There is really no perfect way to do it, and it speaks to how unreasonable 'the right to be forgotten' actually is. When did people ever have a right to be forgotten? No one can force me to forget embarrassing things I've witnessed others do, and vice versa. The same goes for my local copies of photos, videos, diary entries, etc. of such events. Can't make me destroy those love letters you sent. You can't instigate a county-wide manhunt to destroy copies of every local newspaper that covered you in some way you want to forget. You cannot delete most of your public records in real estate, justice, business, etc. You cannot start fresh on your credit history whenever you want. Sure, there is more easily accessible data on the average person with the Internet now, but the majority of the types of data already existed in the pre-Internet-era, perhaps with the exception of ad profiles. Consider all of the political scandals (particularly ones that happened long before they were unearthed) in the pre-Internet era. So, what about when companies have data breaches and expose your data? I think they should absolutely be held liable. But it should be their choice to choose to be liable and determine how much they would need to forget to avoid liability. Furthermore, all of the active users are still compromised with GPDR -- only the people who opted to be forgotten benefit. So instead, there needs to be a framework for addressing data breaches and poor security, rather than deleting every trace of a specific type of data profile that a user and/or associated users posted on your platform.

DanBC 9y ago
> When did people ever have a right to be forgotten? Rehabilitation of offenders act came into force in UK in 1974, so over 40 years. http://www.legislation.gov.uk/ukpga/1974/53/introduction http://www.legislation.gov.uk/ukpga/1974/53/introduction
hvidgaard 9y ago
The Right To Be Forgotten is a reaction to how easy it is to search for information. If I happen to be in a newspaper 5 years ago, you'd had to spend a serious amount of time to find it. With the internet you can just search and get it in a few seconds. > only the people who opted to be forgotten benefit That is not true. One of the main points of GDPR is that you only store data as long as it is reasonable for your business. If I haven't been a customer at a store for 5 years, I can fully expect that my data has been deleted. How long reasonable is will be determined in the court, but I expect it is going to be in the customers favor.
- lend000 9y ago
  It's an overreaction -- people want to have their cake and eat it, too. The thing is, you can't participate in this connected, global world with all its benefits (including an immense amount of available information about everything, including people who have participated in it) and then undo your participation in this information sharing economy. It's an attempt at time travel / rewriting the past, and it's expensive and ultimately impossible to do perfectly. Furthermore, it is unfair to the other participants in this information economy who expect reliable, consistent information. Exceptions for slander and copyrighted information (e.g. photos) that were posted by other users? (or even regular content posted by the user that they 100% own) Absolutely -- but even in these cases, requiring that the third-party platform owners track down all potentially offensive content (much of which may be posted by other users) and then purge every layer of their backups after removing the offending content is overkill and shifts the responsibility away from the offender (whoever posted the content, even if it was the user himself) to the platform owner. Ultimately, the ability to un-publish content you own that you published should be sufficient regulation-wise, and most popular platforms already enable that as a basic feature.
  - hvidgaard 9y ago
    Is it? Before all this tech only specific targeted effort would store information about me. Now everyone is tracked by multiple entities all the time. It's not about undoing participation in information sharing. GPDR does not require Wikipedia to delete everything I've contributed, but the fact that I have contributed is subject to be deleted if I request so. Furthermore, there must be explicit opt-in, and that is a good thing. It's a trivial problem to purge from the backup, really. It's not a hard problem to solve. Many companies have done so before, and now we might even see standard tools to do so.

DanBC 9y ago

> When did people ever have a right to be forgotten? Rehabilitation of offenders act came into force in UK in 1974, so over 40 years. http://www.legislation.gov.uk/ukpga/1974/53/introduction http://www.legislation.gov.uk/ukpga/1974/53/introduction

hvidgaard 9y ago

The Right To Be Forgotten is a reaction to how easy it is to search for information. If I happen to be in a newspaper 5 years ago, you'd had to spend a serious amount of time to find it. With the internet you can just search and get it in a few seconds. > only the people who opted to be forgotten benefit That is not true. One of the main points of GDPR is that you only store data as long as it is reasonable for your business. If I haven't been a customer at a store for 5 years, I can fully expect that my data has been deleted. How long reasonable is will be determined in the court, but I expect it is going to be in the customers favor.

lend000 9y ago
It's an overreaction -- people want to have their cake and eat it, too. The thing is, you can't participate in this connected, global world with all its benefits (including an immense amount of available information about everything, including people who have participated in it) and then undo your participation in this information sharing economy. It's an attempt at time travel / rewriting the past, and it's expensive and ultimately impossible to do perfectly. Furthermore, it is unfair to the other participants in this information economy who expect reliable, consistent information. Exceptions for slander and copyrighted information (e.g. photos) that were posted by other users? (or even regular content posted by the user that they 100% own) Absolutely -- but even in these cases, requiring that the third-party platform owners track down all potentially offensive content (much of which may be posted by other users) and then purge every layer of their backups after removing the offending content is overkill and shifts the responsibility away from the offender (whoever posted the content, even if it was the user himself) to the platform owner. Ultimately, the ability to un-publish content you own that you published should be sufficient regulation-wise, and most popular platforms already enable that as a basic feature.
- hvidgaard 9y ago
  Is it? Before all this tech only specific targeted effort would store information about me. Now everyone is tracked by multiple entities all the time. It's not about undoing participation in information sharing. GPDR does not require Wikipedia to delete everything I've contributed, but the fact that I have contributed is subject to be deleted if I request so. Furthermore, there must be explicit opt-in, and that is a good thing. It's a trivial problem to purge from the backup, really. It's not a hard problem to solve. Many companies have done so before, and now we might even see standard tools to do so.