9 ms·

Well, if the owner of the forum is receiving request e.g. to delete accounts or to disclose what data is recorded about someone, why not just comply with the re

by hjek 8y ago

Well, if the owner of the forum is receiving request e.g. to delete accounts or to disclose what data is recorded about someone, why not just comply with the request? What's the big deal?

xori 8y ago
If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty. It would destroy the usefulness of a forum.
- weberc2 8y ago
  How does GDPR affect people in other countries with no interest in doing business in Europe? If I host a forum in the US and you ask me to remove your posts and I tell you where to stick it, what legal consequences might I face? Erm, asking for a friend.
  - amyjess 8y ago
    As much as I dislike Donald Trump, I am willing to hold my nose here and suggest encouraging the Trump Administration to go full MAGA and direct Congress to pass laws explicitly stating that no foreign judgements or fines may be enforced on US citizens.
    - eximius 8y ago
      I think we understand where you're coming from, but as written this is incredibly ignorant. You're essentially rejecting all international law (copyright, patent, tax, etc).
    - michaelsjoeberg 8y ago
      boom. 1000% increase in foreigners moving/ starting technology companies in the US. seriously tho. great idea.
    - drivingmenuts 8y ago
      Yes, and then they just wait until you show up on their soil (say, on vacation) and arrest you then. Remember Assange? He's fine as long as he stays in the embassy, but step into the back alley for a smoke and he's off to the hoosegow.
    - deleted 8y ago
      [deleted]
  - trentmb 8y ago
    Maybe you do business with someone that does have a footprint in the EU? They can put the screws to them I guess. I imagine visiting an EU member would be unwise as well.
  - tzs 8y ago
    If you aren't in the Union, it applies to you if either [1]: (a) you are processing data of data subjects who are in the union related to the offering of goods or services to such data subjects, or (b) you are processing data of data subjects who are in the union related to monitoring of their behavior as far as their behavior takes place within the Union. If you can avoid both of these, then I believe you can pretty much ignore GDPR. If you have "no interest in doing business in Europe", it should be easy to avoid falling under (a). Recital 23 [2] discusses what it means to be "related to the offering of goods or services" to data subjects in the Union. It means that you have to envisage offering services to such people. The mere accessibility of your website to EU people, or having an email or other contact details in the EU, is insufficient to show such intent. If you offer your website in EU languages that are not generally used in your non-EU country, accept EU currencies, mention your EU customers on your site, and things like that, will strongly suggest you are offering them goods and services. What monitoring of their behavior means is discussed in Recital 24 [3]. It basically means tracking a person for profiling or analyzing or predicting their personal preferences, behaviors and attitudes. Most sites selling things to end users probably don't need to do any such behavioral monitoring. If you do, just do a geoip check and exclude EU IPs. If you aren't trying to do business in Europe you probably want to do that anyway, because EU visitors are just noise in your data. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [2] https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ [3] https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/
    - bigbugbag 8y ago
      geoip based blocking is wrong. An American customer can be travelling in Europe and be blocked while any EU citizen can use a proxy or VPN to workaround your geoip block. If you can live with infuriating a small portion of your customers while have a protection that can be circumvented in a matter of seconds then geoip block is what you want, otherwise ...
      - wan23 8y ago
        It's an efficient way to protect yourself from the regulation. You don't need to prevent Europeans from using your site, you just need to be able to say reasonably that you don't intend to operate in the EU.
- bo1024 8y ago
  Yeah that's an interesting question about the line for GDPR and the right to be forgotten. If a user themself posts text onto a forum, I wouldn't consider that private information. If it's not private info, I wouldn't think they should be able to legally request it be deleted. That would be almost like an editor of a wikipedia article asking that it be removed. I wonder how GDPR applies.
  - LoSboccacc 8y ago
    Gdpr doesn’t have a clause for voluntary, required or accidental sharing. If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind.
    - peteretep 8y ago
      > If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind. I'm really not sure what people think they're gaining from posting these wildly inaccurate GDPR comments.
      - bigbugbag 8y ago
        I agree, the amount of FUD and fearmongering related to GDPR is quite impressive, even here on HN. It seems people who don't like GDPR are trying their best to make it look diabolical as if this would make it go away.
    - detaro 8y ago
      No, you do what's necessary to fullfill the service you provide to the user: they wanted to publish a forum post, you store and publish the submitted data as is necessary to offer this. That's neither a leak nor forbidden.
  - bigbugbag 8y ago
    Actually text posts can be used to personally identify users, given you have access to enough written words from this person to build a profile of their writing style. It's been used to track and identify people. IIRC it's also been used in attempts to impersonate people. So one can argue that text posts are personal data that can be used to identify them, but I suppose this is the kind of thing that is up to the court to decide.
- DanBC 8y ago
  > But if they then said that I need to remove _all of their posts_, that's really shitty. Why do you think GDPR forces forum owners to delete posts? Which bit of GDPR do you think introduces this requirement?
  - TomVDB 8y ago
    In order to reply to your questions, the mark would have to study the GDPR one way or the other to answer them. That by itself is way too much hassle.
    - DanBC 8y ago
      Well, yes, if someone has no idea what's in GDPR they're probably going to be more fearful of all the bullshit being spread about it.
    - im3w1l 8y ago
      It would certainly be interesting to quantify how much money has been spent just trying to understand it
    - bigbugbag 8y ago
      Well the burden of proof lies on the person who makes the claim. otherwise it's an unsubtantiated claim that can be discarded without evidence.
- gregmac 8y ago
  I guess posts are considered 'User Generated Content' which I think falls under the directive. Does that also mean then that quoted content counts? What if another user merely copies/pastes text someone said into their own reply (like you have to do on HN)?
- oh_sigh 8y ago
  In that sense, is hn not GDPR compliant?
- detaro 8y ago
  From what I've seen of the policies in other forums: If they posted actual personal information, admins will edit it out on request, but in general they don't consider posts that don't contain anything identifying personal information and will keep them.
- kinsomo 8y ago
  > If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty. > It would destroy the usefulness of a forum. Couldn't you just anonymize their posts, for instance by updating their username to something like "Deleted User"? Wouldn't you be fine as long as there wasn't anything left to link them to their real identity?
  - LoSboccacc 8y ago
    What if some used quoted another user without the quote function? Or took a snippet from a user as forum signature? Those are easily handled but still if you are a hobbist it’s just too much hassle.
    - protomyth 8y ago
      I asked something similar in the Instapaper story: A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A? I didn't get an answer there. It is basically the same scenario of one user referencing another.
- bigbugbag 8y ago
  Are their posts personal data though ?
crysin 8y ago
From one of his responses in the link "I do appreciate the links. The gdpr documentation is quite long and I lack the domain expertise to read and comprehend the document in full. Perhaps this is cultural, since the United States is a very litigious society, but I would not feel comfortable accepting liability for gdpr compliance without consulting an attorney. It is also unclear how I am expected to respond to DPA execution requests (what the hell is a DPA request?), which I have already received, and what penalties I could face if I fail to provide a sufficient response. Overall, it just seems like outsourcing to StackOverflow or Google Groups makes more sense. This way I can focus my time on making Drone better, as opposed to becoming a legal expert"
- jimnotgym 8y ago
  I think you are right about one thing, the misreading of European law that comes from living in a litigious society. Just act in good faith and GDPR will not bite.
  - mmanfrin 8y ago
    Just act in good faith and GDPR will not bite. Do you have $20million to make that gamble?
    - foepys 8y ago
      Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.
      - malcolmgreaves 8y ago
        Then why does the law not have this an an exemption?
        tambre 8y ago
bryanlarsen 8y ago
He received the "nightmare letter"[1][2] asking for everything possible under GDPR and then some. 1: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... 2: https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter https://jacquesmattheij.com/so-your-start-up-receive-the-nig...
- DanBC 8y ago
  The nightmare letter is bogus scaremongering bullshit. THe forum owner should just i) post a link to the privacy policy (which surely explains things like legitimate needs) and ii) supplies a copy of the data being held.
  - TomVDB 8y ago
    This is so incredibly tonedeaf: do you honestly think that small hobby-scale websites have a privacy policy?
    - synotna 8y ago
      Do you believe that hobbyists must not follow laws & regulations when they interact with the public?
      - TomVDB 8y ago
        Do you believe that anyone who has a hobby website with a forum needs an official privacy document, presumably vetted by a lawyer.
        codedokode 8y ago
        What if a forum owner receives a DMCA letter, or a letter from NSA? You do not really need to consult a lawyer to remove copyrighted material or something else that is illegal.
defertoreptar 8y ago
As someone who ran a forum centered around one of my passions, I was happy to help users out with small adminstrative tasks. Like you said, no big deal. Now if I was legally required to act on every request in 30 days or face potential litigation, that's a totally different story. I'm doing something that's a fun hobby of mine for free that will benefit others with similar interests. The line is drawn when it can have real world consequences and take up a substantial amount of personal time in order to comply with frivolous requests. That's when it stops being fun and definitely not worth risking legal headaches.
- DanBC 8y ago
  > act on every request in 30 days or face potential litigation That's not what happens though. You get a request, you have 30 days to respond to it (and for the vast majority the privacy policy is ok as a response) and if the requester isn't happy they report it to the regulator who writes for more information. In that situation you again send off your privacy policy, maybe with a bit more detail. The regulator either tells you that you're wrong, and explains why, and gives you advice to come back into compliance, or agrees with you and tells the requestor that they've misunderstood the law. And all of this has provisions for proportionality. The regulators will recognise that small forums run for small projects will not have resources to respond to many requests.
  - taysic 8y ago
    If its a hobby and you otherwise have a full time job, 30 days is even too short. Not to mention that's when it stops becoming fun as the person mentioned.
- bigbugbag 8y ago
  This misrepresentation of the situation is well addressed in the other reply, but I'd like to point out that unless your hobby is collecting and processing personal data, you simply have to not collect any personal data as no personal data is required to run a forum, add a page explaining so and direct requests to this page.

by hjek 8y ago

Well, if the owner of the forum is receiving request e.g. to delete accounts or to disclose what data is recorded about someone, why not just comply with the request? What's the big deal?

xori 8y ago

If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty. It would destroy the usefulness of a forum.

weberc2 8y ago
How does GDPR affect people in other countries with no interest in doing business in Europe? If I host a forum in the US and you ask me to remove your posts and I tell you where to stick it, what legal consequences might I face? Erm, asking for a friend.
- amyjess 8y ago
  As much as I dislike Donald Trump, I am willing to hold my nose here and suggest encouraging the Trump Administration to go full MAGA and direct Congress to pass laws explicitly stating that no foreign judgements or fines may be enforced on US citizens.
  - eximius 8y ago
    I think we understand where you're coming from, but as written this is incredibly ignorant. You're essentially rejecting all international law (copyright, patent, tax, etc).
  - michaelsjoeberg 8y ago
    boom. 1000% increase in foreigners moving/ starting technology companies in the US. seriously tho. great idea.
  - drivingmenuts 8y ago
    Yes, and then they just wait until you show up on their soil (say, on vacation) and arrest you then. Remember Assange? He's fine as long as he stays in the embassy, but step into the back alley for a smoke and he's off to the hoosegow.
  - deleted 8y ago
    [deleted]
- trentmb 8y ago
  Maybe you do business with someone that does have a footprint in the EU? They can put the screws to them I guess. I imagine visiting an EU member would be unwise as well.
- tzs 8y ago
  If you aren't in the Union, it applies to you if either [1]: (a) you are processing data of data subjects who are in the union related to the offering of goods or services to such data subjects, or (b) you are processing data of data subjects who are in the union related to monitoring of their behavior as far as their behavior takes place within the Union. If you can avoid both of these, then I believe you can pretty much ignore GDPR. If you have "no interest in doing business in Europe", it should be easy to avoid falling under (a). Recital 23 [2] discusses what it means to be "related to the offering of goods or services" to data subjects in the Union. It means that you have to envisage offering services to such people. The mere accessibility of your website to EU people, or having an email or other contact details in the EU, is insufficient to show such intent. If you offer your website in EU languages that are not generally used in your non-EU country, accept EU currencies, mention your EU customers on your site, and things like that, will strongly suggest you are offering them goods and services. What monitoring of their behavior means is discussed in Recital 24 [3]. It basically means tracking a person for profiling or analyzing or predicting their personal preferences, behaviors and attitudes. Most sites selling things to end users probably don't need to do any such behavioral monitoring. If you do, just do a geoip check and exclude EU IPs. If you aren't trying to do business in Europe you probably want to do that anyway, because EU visitors are just noise in your data. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [2] https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ [3] https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/
  - bigbugbag 8y ago
    geoip based blocking is wrong. An American customer can be travelling in Europe and be blocked while any EU citizen can use a proxy or VPN to workaround your geoip block. If you can live with infuriating a small portion of your customers while have a protection that can be circumvented in a matter of seconds then geoip block is what you want, otherwise ...
    - wan23 8y ago
      It's an efficient way to protect yourself from the regulation. You don't need to prevent Europeans from using your site, you just need to be able to say reasonably that you don't intend to operate in the EU.
bo1024 8y ago
Yeah that's an interesting question about the line for GDPR and the right to be forgotten. If a user themself posts text onto a forum, I wouldn't consider that private information. If it's not private info, I wouldn't think they should be able to legally request it be deleted. That would be almost like an editor of a wikipedia article asking that it be removed. I wonder how GDPR applies.
- LoSboccacc 8y ago
  Gdpr doesn’t have a clause for voluntary, required or accidental sharing. If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind.
  - peteretep 8y ago
    > If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind. I'm really not sure what people think they're gaining from posting these wildly inaccurate GDPR comments.
    - bigbugbag 8y ago
      I agree, the amount of FUD and fearmongering related to GDPR is quite impressive, even here on HN. It seems people who don't like GDPR are trying their best to make it look diabolical as if this would make it go away.
  - detaro 8y ago
    No, you do what's necessary to fullfill the service you provide to the user: they wanted to publish a forum post, you store and publish the submitted data as is necessary to offer this. That's neither a leak nor forbidden.
- bigbugbag 8y ago
  Actually text posts can be used to personally identify users, given you have access to enough written words from this person to build a profile of their writing style. It's been used to track and identify people. IIRC it's also been used in attempts to impersonate people. So one can argue that text posts are personal data that can be used to identify them, but I suppose this is the kind of thing that is up to the court to decide.
DanBC 8y ago
> But if they then said that I need to remove _all of their posts_, that's really shitty. Why do you think GDPR forces forum owners to delete posts? Which bit of GDPR do you think introduces this requirement?
- TomVDB 8y ago
  In order to reply to your questions, the mark would have to study the GDPR one way or the other to answer them. That by itself is way too much hassle.
  - DanBC 8y ago
    Well, yes, if someone has no idea what's in GDPR they're probably going to be more fearful of all the bullshit being spread about it.
  - im3w1l 8y ago
    It would certainly be interesting to quantify how much money has been spent just trying to understand it
  - bigbugbag 8y ago
    Well the burden of proof lies on the person who makes the claim. otherwise it's an unsubtantiated claim that can be discarded without evidence.
gregmac 8y ago
I guess posts are considered 'User Generated Content' which I think falls under the directive. Does that also mean then that quoted content counts? What if another user merely copies/pastes text someone said into their own reply (like you have to do on HN)?
oh_sigh 8y ago
In that sense, is hn not GDPR compliant?
detaro 8y ago
From what I've seen of the policies in other forums: If they posted actual personal information, admins will edit it out on request, but in general they don't consider posts that don't contain anything identifying personal information and will keep them.
kinsomo 8y ago
> If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty. > It would destroy the usefulness of a forum. Couldn't you just anonymize their posts, for instance by updating their username to something like "Deleted User"? Wouldn't you be fine as long as there wasn't anything left to link them to their real identity?
- LoSboccacc 8y ago
  What if some used quoted another user without the quote function? Or took a snippet from a user as forum signature? Those are easily handled but still if you are a hobbist it’s just too much hassle.
  - protomyth 8y ago
    I asked something similar in the Instapaper story: A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A? I didn't get an answer there. It is basically the same scenario of one user referencing another.
bigbugbag 8y ago
Are their posts personal data though ?

crysin 8y ago

From one of his responses in the link "I do appreciate the links. The gdpr documentation is quite long and I lack the domain expertise to read and comprehend the document in full. Perhaps this is cultural, since the United States is a very litigious society, but I would not feel comfortable accepting liability for gdpr compliance without consulting an attorney. It is also unclear how I am expected to respond to DPA execution requests (what the hell is a DPA request?), which I have already received, and what penalties I could face if I fail to provide a sufficient response. Overall, it just seems like outsourcing to StackOverflow or Google Groups makes more sense. This way I can focus my time on making Drone better, as opposed to becoming a legal expert"

jimnotgym 8y ago
I think you are right about one thing, the misreading of European law that comes from living in a litigious society. Just act in good faith and GDPR will not bite.
- mmanfrin 8y ago
  Just act in good faith and GDPR will not bite. Do you have $20million to make that gamble?
  - foepys 8y ago
    Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.
    - malcolmgreaves 8y ago
      Then why does the law not have this an an exemption?
      - tambre 8y ago

bryanlarsen 8y ago

He received the "nightmare letter"[1][2] asking for everything possible under GDPR and then some. 1: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... 2: https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter https://jacquesmattheij.com/so-your-start-up-receive-the-nig...

DanBC 8y ago
The nightmare letter is bogus scaremongering bullshit. THe forum owner should just i) post a link to the privacy policy (which surely explains things like legitimate needs) and ii) supplies a copy of the data being held.
- TomVDB 8y ago
  This is so incredibly tonedeaf: do you honestly think that small hobby-scale websites have a privacy policy?
  - synotna 8y ago
    Do you believe that hobbyists must not follow laws & regulations when they interact with the public?
    - TomVDB 8y ago
      Do you believe that anyone who has a hobby website with a forum needs an official privacy document, presumably vetted by a lawyer.
      - codedokode 8y ago
        What if a forum owner receives a DMCA letter, or a letter from NSA? You do not really need to consult a lawyer to remove copyrighted material or something else that is illegal.

defertoreptar 8y ago

As someone who ran a forum centered around one of my passions, I was happy to help users out with small adminstrative tasks. Like you said, no big deal. Now if I was legally required to act on every request in 30 days or face potential litigation, that's a totally different story. I'm doing something that's a fun hobby of mine for free that will benefit others with similar interests. The line is drawn when it can have real world consequences and take up a substantial amount of personal time in order to comply with frivolous requests. That's when it stops being fun and definitely not worth risking legal headaches.

DanBC 8y ago
> act on every request in 30 days or face potential litigation That's not what happens though. You get a request, you have 30 days to respond to it (and for the vast majority the privacy policy is ok as a response) and if the requester isn't happy they report it to the regulator who writes for more information. In that situation you again send off your privacy policy, maybe with a bit more detail. The regulator either tells you that you're wrong, and explains why, and gives you advice to come back into compliance, or agrees with you and tells the requestor that they've misunderstood the law. And all of this has provisions for proportionality. The regulators will recognise that small forums run for small projects will not have resources to respond to many requests.
- taysic 8y ago
  If its a hobby and you otherwise have a full time job, 30 days is even too short. Not to mention that's when it stops becoming fun as the person mentioned.
bigbugbag 8y ago
This misrepresentation of the situation is well addressed in the other reply, but I'd like to point out that unless your hobby is collecting and processing personal data, you simply have to not collect any personal data as no personal data is required to run a forum, add a page explaining so and direct requests to this page.