5 ms·

Upon cursory inspection, the single fact that user don't seem to be able to delete their account data from here would make it not compliant. Similarly the inab

Upon cursory inspection, the single fact that user don't seem to be able to delete their account data from here would make it not compliant. Similarly the inability to delete posts after a certain time may also conflict with the data removal stipulation of GDPR. But as a corollary to that, GDPR laws seem to only apply where there is data that can personally identify a user. The usage of nicknames and throwaway accounts on here may mean that GDPR requirements may be able to be ignored as long as there is no piece of data that can be linked back to an identifiable user (such as an email address in their profile etc.) Note: IANAL - So please take this as my opinion, and not a legal finding.

Geee 9y ago
You don't have to follow any of the rules in the GDPR if you have a good reason for doing so, which doesn't overstep the basic rights of the person. Being able to operate the business in the way that it's intended is a fine reason. So, user comments don't have to be deleted because that would change the way HN operates and creates value. However, it's harder to explain why the comments can't be anonymized by unlinking it from the user table and changing the username to 'deleted'.
dangrossman 9y ago
Nothing in the GDPR says you must be able to delete your own data. It says that you may request a business delete your personal data, and they may have to comply if they don't have a legitimate business reason not to. There's a balancing test, not a blanket requirement that every web app be littered with delete buttons.