11 ms·

If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their p

by xori 8y ago

If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty. It would destroy the usefulness of a forum.

weberc2 8y ago
How does GDPR affect people in other countries with no interest in doing business in Europe? If I host a forum in the US and you ask me to remove your posts and I tell you where to stick it, what legal consequences might I face? Erm, asking for a friend.
- amyjess 8y ago
  As much as I dislike Donald Trump, I am willing to hold my nose here and suggest encouraging the Trump Administration to go full MAGA and direct Congress to pass laws explicitly stating that no foreign judgements or fines may be enforced on US citizens.
  - eximius 8y ago
    I think we understand where you're coming from, but as written this is incredibly ignorant. You're essentially rejecting all international law (copyright, patent, tax, etc).
  - michaelsjoeberg 8y ago
    boom. 1000% increase in foreigners moving/ starting technology companies in the US. seriously tho. great idea.
  - drivingmenuts 8y ago
    Yes, and then they just wait until you show up on their soil (say, on vacation) and arrest you then. Remember Assange? He's fine as long as he stays in the embassy, but step into the back alley for a smoke and he's off to the hoosegow.
  - deleted 8y ago
    [deleted]
- trentmb 8y ago
  Maybe you do business with someone that does have a footprint in the EU? They can put the screws to them I guess. I imagine visiting an EU member would be unwise as well.
- tzs 8y ago
  If you aren't in the Union, it applies to you if either [1]: (a) you are processing data of data subjects who are in the union related to the offering of goods or services to such data subjects, or (b) you are processing data of data subjects who are in the union related to monitoring of their behavior as far as their behavior takes place within the Union. If you can avoid both of these, then I believe you can pretty much ignore GDPR. If you have "no interest in doing business in Europe", it should be easy to avoid falling under (a). Recital 23 [2] discusses what it means to be "related to the offering of goods or services" to data subjects in the Union. It means that you have to envisage offering services to such people. The mere accessibility of your website to EU people, or having an email or other contact details in the EU, is insufficient to show such intent. If you offer your website in EU languages that are not generally used in your non-EU country, accept EU currencies, mention your EU customers on your site, and things like that, will strongly suggest you are offering them goods and services. What monitoring of their behavior means is discussed in Recital 24 [3]. It basically means tracking a person for profiling or analyzing or predicting their personal preferences, behaviors and attitudes. Most sites selling things to end users probably don't need to do any such behavioral monitoring. If you do, just do a geoip check and exclude EU IPs. If you aren't trying to do business in Europe you probably want to do that anyway, because EU visitors are just noise in your data. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [2] https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ [3] https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/
  - bigbugbag 8y ago
    geoip based blocking is wrong. An American customer can be travelling in Europe and be blocked while any EU citizen can use a proxy or VPN to workaround your geoip block. If you can live with infuriating a small portion of your customers while have a protection that can be circumvented in a matter of seconds then geoip block is what you want, otherwise ...
    - wan23 8y ago
      It's an efficient way to protect yourself from the regulation. You don't need to prevent Europeans from using your site, you just need to be able to say reasonably that you don't intend to operate in the EU.
bo1024 8y ago
Yeah that's an interesting question about the line for GDPR and the right to be forgotten. If a user themself posts text onto a forum, I wouldn't consider that private information. If it's not private info, I wouldn't think they should be able to legally request it be deleted. That would be almost like an editor of a wikipedia article asking that it be removed. I wonder how GDPR applies.
- LoSboccacc 8y ago
  Gdpr doesn’t have a clause for voluntary, required or accidental sharing. If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind.
  - peteretep 8y ago
    > If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind. I'm really not sure what people think they're gaining from posting these wildly inaccurate GDPR comments.
    - bigbugbag 8y ago
      I agree, the amount of FUD and fearmongering related to GDPR is quite impressive, even here on HN. It seems people who don't like GDPR are trying their best to make it look diabolical as if this would make it go away.
  - detaro 8y ago
    No, you do what's necessary to fullfill the service you provide to the user: they wanted to publish a forum post, you store and publish the submitted data as is necessary to offer this. That's neither a leak nor forbidden.
- bigbugbag 8y ago
  Actually text posts can be used to personally identify users, given you have access to enough written words from this person to build a profile of their writing style. It's been used to track and identify people. IIRC it's also been used in attempts to impersonate people. So one can argue that text posts are personal data that can be used to identify them, but I suppose this is the kind of thing that is up to the court to decide.
DanBC 8y ago
> But if they then said that I need to remove _all of their posts_, that's really shitty. Why do you think GDPR forces forum owners to delete posts? Which bit of GDPR do you think introduces this requirement?
- TomVDB 8y ago
  In order to reply to your questions, the mark would have to study the GDPR one way or the other to answer them. That by itself is way too much hassle.
  - DanBC 8y ago
    Well, yes, if someone has no idea what's in GDPR they're probably going to be more fearful of all the bullshit being spread about it.
  - im3w1l 8y ago
    It would certainly be interesting to quantify how much money has been spent just trying to understand it
  - bigbugbag 8y ago
    Well the burden of proof lies on the person who makes the claim. otherwise it's an unsubtantiated claim that can be discarded without evidence.
gregmac 8y ago
I guess posts are considered 'User Generated Content' which I think falls under the directive. Does that also mean then that quoted content counts? What if another user merely copies/pastes text someone said into their own reply (like you have to do on HN)?
oh_sigh 8y ago
In that sense, is hn not GDPR compliant?
detaro 8y ago
From what I've seen of the policies in other forums: If they posted actual personal information, admins will edit it out on request, but in general they don't consider posts that don't contain anything identifying personal information and will keep them.
kinsomo 8y ago
> If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty. > It would destroy the usefulness of a forum. Couldn't you just anonymize their posts, for instance by updating their username to something like "Deleted User"? Wouldn't you be fine as long as there wasn't anything left to link them to their real identity?
- LoSboccacc 8y ago
  What if some used quoted another user without the quote function? Or took a snippet from a user as forum signature? Those are easily handled but still if you are a hobbist it’s just too much hassle.
  - protomyth 8y ago
    I asked something similar in the Instapaper story: A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A? I didn't get an answer there. It is basically the same scenario of one user referencing another.
bigbugbag 8y ago
Are their posts personal data though ?

by xori 8y ago

weberc2 8y ago

How does GDPR affect people in other countries with no interest in doing business in Europe? If I host a forum in the US and you ask me to remove your posts and I tell you where to stick it, what legal consequences might I face? Erm, asking for a friend.

amyjess 8y ago
As much as I dislike Donald Trump, I am willing to hold my nose here and suggest encouraging the Trump Administration to go full MAGA and direct Congress to pass laws explicitly stating that no foreign judgements or fines may be enforced on US citizens.
- eximius 8y ago
  I think we understand where you're coming from, but as written this is incredibly ignorant. You're essentially rejecting all international law (copyright, patent, tax, etc).
- michaelsjoeberg 8y ago
  boom. 1000% increase in foreigners moving/ starting technology companies in the US. seriously tho. great idea.
- drivingmenuts 8y ago
  Yes, and then they just wait until you show up on their soil (say, on vacation) and arrest you then. Remember Assange? He's fine as long as he stays in the embassy, but step into the back alley for a smoke and he's off to the hoosegow.
- deleted 8y ago
  [deleted]
trentmb 8y ago
Maybe you do business with someone that does have a footprint in the EU? They can put the screws to them I guess. I imagine visiting an EU member would be unwise as well.
tzs 8y ago
If you aren't in the Union, it applies to you if either [1]: (a) you are processing data of data subjects who are in the union related to the offering of goods or services to such data subjects, or (b) you are processing data of data subjects who are in the union related to monitoring of their behavior as far as their behavior takes place within the Union. If you can avoid both of these, then I believe you can pretty much ignore GDPR. If you have "no interest in doing business in Europe", it should be easy to avoid falling under (a). Recital 23 [2] discusses what it means to be "related to the offering of goods or services" to data subjects in the Union. It means that you have to envisage offering services to such people. The mere accessibility of your website to EU people, or having an email or other contact details in the EU, is insufficient to show such intent. If you offer your website in EU languages that are not generally used in your non-EU country, accept EU currencies, mention your EU customers on your site, and things like that, will strongly suggest you are offering them goods and services. What monitoring of their behavior means is discussed in Recital 24 [3]. It basically means tracking a person for profiling or analyzing or predicting their personal preferences, behaviors and attitudes. Most sites selling things to end users probably don't need to do any such behavioral monitoring. If you do, just do a geoip check and exclude EU IPs. If you aren't trying to do business in Europe you probably want to do that anyway, because EU visitors are just noise in your data. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [2] https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ [3] https://gdpr-info.eu/recitals/no-24/ https://gdpr-info.eu/recitals/no-24/
- bigbugbag 8y ago
  geoip based blocking is wrong. An American customer can be travelling in Europe and be blocked while any EU citizen can use a proxy or VPN to workaround your geoip block. If you can live with infuriating a small portion of your customers while have a protection that can be circumvented in a matter of seconds then geoip block is what you want, otherwise ...
  - wan23 8y ago
    It's an efficient way to protect yourself from the regulation. You don't need to prevent Europeans from using your site, you just need to be able to say reasonably that you don't intend to operate in the EU.

bo1024 8y ago

Yeah that's an interesting question about the line for GDPR and the right to be forgotten. If a user themself posts text onto a forum, I wouldn't consider that private information. If it's not private info, I wouldn't think they should be able to legally request it be deleted. That would be almost like an editor of a wikipedia article asking that it be removed. I wonder how GDPR applies.

LoSboccacc 8y ago
Gdpr doesn’t have a clause for voluntary, required or accidental sharing. If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind.
- peteretep 8y ago
  > If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind. I'm really not sure what people think they're gaining from posting these wildly inaccurate GDPR comments.
  - bigbugbag 8y ago
    I agree, the amount of FUD and fearmongering related to GDPR is quite impressive, even here on HN. It seems people who don't like GDPR are trying their best to make it look diabolical as if this would make it go away.
- detaro 8y ago
  No, you do what's necessary to fullfill the service you provide to the user: they wanted to publish a forum post, you store and publish the submitted data as is necessary to offer this. That's neither a leak nor forbidden.
bigbugbag 8y ago
Actually text posts can be used to personally identify users, given you have access to enough written words from this person to build a profile of their writing style. It's been used to track and identify people. IIRC it's also been used in attempts to impersonate people. So one can argue that text posts are personal data that can be used to identify them, but I suppose this is the kind of thing that is up to the court to decide.

DanBC 8y ago

> But if they then said that I need to remove _all of their posts_, that's really shitty. Why do you think GDPR forces forum owners to delete posts? Which bit of GDPR do you think introduces this requirement?

TomVDB 8y ago
In order to reply to your questions, the mark would have to study the GDPR one way or the other to answer them. That by itself is way too much hassle.
- DanBC 8y ago
  Well, yes, if someone has no idea what's in GDPR they're probably going to be more fearful of all the bullshit being spread about it.
- im3w1l 8y ago
  It would certainly be interesting to quantify how much money has been spent just trying to understand it
- bigbugbag 8y ago
  Well the burden of proof lies on the person who makes the claim. otherwise it's an unsubtantiated claim that can be discarded without evidence.

gregmac 8y ago

I guess posts are considered 'User Generated Content' which I think falls under the directive. Does that also mean then that quoted content counts? What if another user merely copies/pastes text someone said into their own reply (like you have to do on HN)?

oh_sigh 8y ago

In that sense, is hn not GDPR compliant?

detaro 8y ago

From what I've seen of the policies in other forums: If they posted actual personal information, admins will edit it out on request, but in general they don't consider posts that don't contain anything identifying personal information and will keep them.

kinsomo 8y ago

> If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty. > It would destroy the usefulness of a forum. Couldn't you just anonymize their posts, for instance by updating their username to something like "Deleted User"? Wouldn't you be fine as long as there wasn't anything left to link them to their real identity?

LoSboccacc 8y ago
What if some used quoted another user without the quote function? Or took a snippet from a user as forum signature? Those are easily handled but still if you are a hobbist it’s just too much hassle.
- protomyth 8y ago
  I asked something similar in the Instapaper story: A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A? I didn't get an answer there. It is basically the same scenario of one user referencing another.

bigbugbag 8y ago

Are their posts personal data though ?