5 ms·

I'm a European that supports the GDPR but here's my take on the issue in the post. I don't think it would be hard for the person in the post to comply, it woul

by tephra 8y ago

I'm a European that supports the GDPR but here's my take on the issue in the post. I don't think it would be hard for the person in the post to comply, it would just be time consuming. Say for example that a user requests a data transcript. Well he will have to collect all the post etc from that user and send it somehow. Now this is probably just a simple SQL query but it takes a bit of time, time that many people don't have. Another issue seems to be that he is afraid of repercussions and is conditioned in the US system where everyone seems to be suing everyone all the time.

jopsen 8y ago
On HN I can go to my user profile and see all comments/posts I've made. And I can delete them all. I strongly suspect this sufficient. Maybe it would be ideal to offer a "delete account" and "download account" button. But there is no reason you should be processing letters from people. I'm not even sure you need to offer removal of public information. But allowing deletions of accounts is hardly controversial.
- codedokode 8y ago
  Also it would be a good idea not to keep IP addresses forever. Two weeks retention is enough to detect mass registration.
- ItsMe000001 8y ago
  > And I can delete them all. How? I can only delete for a small amount of time after posting. I cannot delete any of my past comments. If there is an option to remove old(er) comments I would sure like to know about it, seems to be hidden pretty well.
codedokode 8y ago
Cannot he irreversibly delete user's data instead and send an empty file?
peteretep 8y ago
I'd be surprised if the forum software he uses doesn't already support self-service for that
dnomad 8y ago
It's not clear that a forum administrator would need to do anything under the GDPR except respond to emails with the standard template: "The forum does not collect or process any personal data." Technically, I suspect, this would be true. The GDPR and the right to be forgotten are subtle on this. If a user chooses, unprompted, to share PII it's not clear that collection has taken place. Imagine a user, out of the blue, uploads her bank account information to a forum and others take the credentials and steal or her money. Would anybody seriously believe that the business should be liable for failing to secure the PII data? The other question is whether such data can be said to be processed. Clearly the forum is not processing the PII data as PII data. It's likely the case that the business doesn't know that any given forum contains PII data. The GDPR also gives businesses a lot of lee way here. Erasure requests can be rejected under "freedom of information", if they cause undue burden a fee can be demanded, or if they're just frivolous they can be outright refused [1]. Admittedly this is speculation. European regulation is rules-based and a lot of leeway is given to regulators. The right to be forgotten is probably the least concrete aspect of the law. It's not clear how it intersects with user-generated content because it's not clear that PII is even being collected here. In the end, I suspect the regulators and the courts would probably be open to good faith efforts towards compliance. This might take the form of removing account data (username, emails, profile pictures) but leaving the forum posts up. If a specific forum post is believed to contain PII the business might ask the user to explain how the data in the post could be used to personally identify them as a data subject. [1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- detaro 8y ago
  Usernames can be identifying, as could other profile information. IP addresses in server logs. Those are easily under your control, and you should mention those as things you process, but also are easy to justify assuming you don't do anything weird with them.
  - deleted 8y ago
    [deleted]
andruby 8y ago
The forum uses discourse, an open source forum software. I'm sure someone will soon add the functionality for users to download their data from discourse. And then you only need to have a standard email reply pointing GDRP requesters to that functionality. Why are US companies/citizens overreacting so much? I haven't seen any company or sideproject from a different country react this way. (please let me know if I'm wrong)

by tephra 8y ago

jopsen 8y ago

On HN I can go to my user profile and see all comments/posts I've made. And I can delete them all. I strongly suspect this sufficient. Maybe it would be ideal to offer a "delete account" and "download account" button. But there is no reason you should be processing letters from people. I'm not even sure you need to offer removal of public information. But allowing deletions of accounts is hardly controversial.

codedokode 8y ago
Also it would be a good idea not to keep IP addresses forever. Two weeks retention is enough to detect mass registration.
ItsMe000001 8y ago
> And I can delete them all. How? I can only delete for a small amount of time after posting. I cannot delete any of my past comments. If there is an option to remove old(er) comments I would sure like to know about it, seems to be hidden pretty well.

codedokode 8y ago

Cannot he irreversibly delete user's data instead and send an empty file?

peteretep 8y ago

I'd be surprised if the forum software he uses doesn't already support self-service for that

dnomad 8y ago

It's not clear that a forum administrator would need to do anything under the GDPR except respond to emails with the standard template: "The forum does not collect or process any personal data." Technically, I suspect, this would be true. The GDPR and the right to be forgotten are subtle on this. If a user chooses, unprompted, to share PII it's not clear that collection has taken place. Imagine a user, out of the blue, uploads her bank account information to a forum and others take the credentials and steal or her money. Would anybody seriously believe that the business should be liable for failing to secure the PII data? The other question is whether such data can be said to be processed. Clearly the forum is not processing the PII data as PII data. It's likely the case that the business doesn't know that any given forum contains PII data. The GDPR also gives businesses a lot of lee way here. Erasure requests can be rejected under "freedom of information", if they cause undue burden a fee can be demanded, or if they're just frivolous they can be outright refused [1]. Admittedly this is speculation. European regulation is rules-based and a lot of leeway is given to regulators. The right to be forgotten is probably the least concrete aspect of the law. It's not clear how it intersects with user-generated content because it's not clear that PII is even being collected here. In the end, I suspect the regulators and the courts would probably be open to good faith efforts towards compliance. This might take the form of removing account data (username, emails, profile pictures) but leaving the forum posts up. If a specific forum post is believed to contain PII the business might ask the user to explain how the data in the post could be used to personally identify them as a data subject. [1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

detaro 8y ago
Usernames can be identifying, as could other profile information. IP addresses in server logs. Those are easily under your control, and you should mention those as things you process, but also are easy to justify assuming you don't do anything weird with them.
- deleted 8y ago
  [deleted]

andruby 8y ago

The forum uses discourse, an open source forum software. I'm sure someone will soon add the functionality for users to download their data from discourse. And then you only need to have a standard email reply pointing GDRP requesters to that functionality. Why are US companies/citizens overreacting so much? I haven't seen any company or sideproject from a different country react this way. (please let me know if I'm wrong)