7 ms·

I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data

I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data of him/her left anyway. If there is data left just collect it, send it to the person and delete it afterwards (surely there’s a way to search posts by author in their forum software). I can understand that such requests are difficult to answer for companies that run many different IT services, but this case seems pretty trivial to me.

trothamel 8y ago
It seems like the AggregateIQ case shows the problem with this - by obeying the request, they admit that the EU has jurisdiction over them. That's probably the wrong thing to do when they have no connection to the EU, other than people from the EU choosing to connect to a server hosted elsewhere. It's probably the same reason why Hacker News does nothing to comply with the GDPR.
- nindalf 8y ago
  Has someone associated with HN explicitly said anything about complying with GDPR? If yes, do you have a link?
- doppel 8y ago
  Jurisdiction is a tricky concept in cases like these where we are dealing with digital content. AggregateIQ could have ignored the GDPR-request, ignored any rulings and keep chugging along as long as they stuck to Canada (assuming Canada was not going to side with the EU). In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. Same as if some banana republic dictator declares you persona non grata - if you never intend to visit and otherwise have no business in that country, who cares? The difference is that the EU is not a banana republic (opinions may vary), and so many choose to respect and accept this their judgement in cases like this to stay on good terms.
  - treis 8y ago
    >In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. That's not entirely true. You can go to a Canadian court to enforce an EU judgement against assets in Canada. So for example, if you cause a car accident in Germany, the plaintiff can sue you in Germany to get a judgement and then sue you in Canada to enforce that judgement. How Canadian (or US or otherwise) courts will treat a GDPR judgement remains to be seen, but it's not a guarantee that it won't be enforced.
- adventured 8y ago
  Your legal concept isn't valid. Hacker News can comply with GDPR today and choose not to comply the next day. They forfeit nothing in the process of selectively abandoning GDPR, in regards to being governed by US law and not EU law. If my company is located in the US and only governed by US jurisdiction (eg I do not operate in the EU in any manner), there's no such concept as admitting the EU has jurisdiction over my company and granting the EU new global powers (such that I can provide the EU jurisdictional reach into the US so that it overrules or competes with US law). That isn't my decision to make if I operate inside the US jurisdiction. The US solely decides jurisdiction within its zone of political control. That is, the US has the final say legally in all regards in that case. I could choose to voluntarily comply with GDPR, however the EU has zero power to force me to. I can flip flop back and forth a thousand times, or not, it makes no difference. If you ever find yourself wondering about these concepts, change the scenario to China. Under what scenario does the EU or US have power to dictate laws within China? None. It provides a perfect clarification every time. Nobody could possibly be confused about who is in charge of law within China.
  - trothamel 8y ago
    I think we mostly agree, especially when you bring China into it. However, isn't the idea of forfeiting the personal jurisdiction defense? I am not a lawyer, but from what I understand, once you start debating the merits of the case, you waive the ability to claim that the court doesn't have jurisdiction. It seems like there's a bit of a chance of that here - once you admit the EU or Chinese legal system is the appropriate place to redress things, you've given up lack of jurisdiction as a defense.
    - zaarn 8y ago
      A GDPR Deletion Request is not a court case, it's a non-formal notification that you want someone to delete data about you. If someone follows that request and if the EU has jurisdiction are orthogonal issues; plenty of services offered deletion before the GDPR. The question of jurisdiction will come up if you ignore requests or otherwise violate the GDPR and a national agency that is responsible for handling violations contacts you. In which case you can still choose to ignore them, if you're not on EU soil, then it's up to the extradition or similar laws on what happens; the agency will likely file a court case (or you file), then the court will handle out the details with your national legal system; in most cases this means nationalizing any punishment. Ie, the court case will be handled and if you don't show up after being invited, will be ruled upon in your absence. Then the fine will be forwarded to your country where the courts in your country with your countries jursdiction will then collect it, probably take a fee and then forward the remainder back to the EU. An alternative outcome would be that the entire court case is moved into your country. Either way, complying to GDPR-related requests doesn't mean admitting jurisdiction of the EU; disagreeing the responsible government agencies involved is a good way to test if those have jurisdiction.
- Symbiote 8y ago
  I'd expect HN to be subject to the GDPR, since they show job adverts for startups in the EU on the front page.
  - robdachshund 8y ago
    Yet they are not compliant and you cannot delete posts or accounts. Pretty sure YC does business in the EU as well. Enough to be subject to GDPR at least.
dleslie 8y ago
The hobbyists may not have access to do so. Perhaps their site is on a VPS or worse, a SAAS product? And why should a Canadian running a site on American servers have to fear EU law? Why isn't it the EU citizen's responsibility to know, understand and abide by the rules and regulations of the countries they're visiting online?
- dmitriid 8y ago
  Why should a European citizen abide by the laws of a different country (which may be illigal in their country BTW)
  - trothamel 8y ago
    They shouldn't, but it's not their problem. If I, as the prince of Princeton, was to pass a law that each time one of my subjects visits your website, you must pay me $1, you'd think that's mad. And you'd be right - since you're not bound by Princeton laws. The EU is claiming that sites in other countries are bound by EU laws - and that's just as wrong as if Princeton passed the laws.
    - Semaphor 8y ago
      Countries (or conglomerates of them) applying their laws world-wide has long been what the US does on the internet. It's a bit too late to put that genie back in the bottle.
      - hnra 8y ago
        A website hosted outside of US jurisdiction will rarely get in trouble for breaking US specific laws.
        robin_reala 8y ago
        But if the owners of that website visit the US they’re liable to be arrested (assuming the site has enough impact). Same in reverse.
belorn 8y ago
It is very doubtful there is any need to search posts. The data are still necessary for the purpose they were originally collected, and there is also a archiving exception which may apply. If I was them I would just send the person their login profile and delete that from the site. Everything else is excepted, including backups which are kept for security. A good community example to look at is Wikipedia. I will star to worry if and when I see them start deleting profiles and articles. Until then I see this kind of articles like a bit of scared interpretation of how nations might implement and apply GDPR.
- atoav 8y ago
  An article you agreed to publish on a public encyclopedia hardly counts as personal data..
  - x0x0 8y ago
    Person B mentions person A by name or by nym. Person B describes person A without mentioning a name, eg by describing person A in a way which is recognizable. (eg the pilot that shot down the death star.) The first is at least searchable...
    - geocar 8y ago
      But neither are in scope. The GDPR makes exceptions for journalistic use cases (An encyclopedia certainly counts; see Article 85 and 89), and it does not require that you link a person (e.g. in your second case; see Recital 26) if you have no other reason to do. If someone persists, Article 11 makes it possible to put the onus on the person to identify any data in this category. - https://gdpr-info.eu/art-89-gdpr/ https://gdpr-info.eu/art-89-gdpr/ - https://gdpr-info.eu/art-85-gdpr/ https://gdpr-info.eu/art-85-gdpr/ - https://gdpr-info.eu/art-11-gdpr/ https://gdpr-info.eu/art-11-gdpr/ - https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/
- x0x0 8y ago
  data being necessary for original purpose doesn't help; you can withdraw consent
tokyodude 8y ago
> ThePhysicist: I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data of him/her left anyway. Deleting all posts in a forum by a certain user will not delete all posts in a forum by other users that quoted the user who desires to have their data deleted.
- TheSpiceIsLife 8y ago
  I'm not software expert by any means, but couldn't the deletion script also do a search for quoted text, at least sufficient to comply with the reasonable steps language of the legislation?
  - soul_grafitti 8y ago
    > TheSpiceIsLife > I'm not software expert by any means, but couldn't the deletion script also do a search for quoted text, at least sufficient to comply with the reasonable steps language of the legislation? Devil meet details
- hopler 8y ago
  That's fine. A quote isn't the original speaker's data. It's the quoter's data.
  - centering 8y ago
    Lol
  - wutbrodo 8y ago
    I would assume so, but are you confident that the law unambiguously permits this? This isn't a rhetorical question, as I don't know a ton about the GDPR, but uncertainty is one of the worst forms of regulatory costs, so it's not really something you can wave off without knowing how it will be interpreted.
  - tokyodude 8y ago
    By that argument google's index of data isn't the user's data it's google's but the right to be forgotten is specifically about deleting other people's copies of data about a person. In particular the NYTimes reports on Joe Baddy doing something bad. That article arguably belongs to the NYTimes. Google indexes that article with permission from NYTimes. Right to be forgotten requires Google remove the link to NYTimes even though neither Google's index nor the article at NYTimes belong to user.

trothamel 8y ago

It seems like the AggregateIQ case shows the problem with this - by obeying the request, they admit that the EU has jurisdiction over them. That's probably the wrong thing to do when they have no connection to the EU, other than people from the EU choosing to connect to a server hosted elsewhere. It's probably the same reason why Hacker News does nothing to comply with the GDPR.

nindalf 8y ago
Has someone associated with HN explicitly said anything about complying with GDPR? If yes, do you have a link?
doppel 8y ago
Jurisdiction is a tricky concept in cases like these where we are dealing with digital content. AggregateIQ could have ignored the GDPR-request, ignored any rulings and keep chugging along as long as they stuck to Canada (assuming Canada was not going to side with the EU). In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. Same as if some banana republic dictator declares you persona non grata - if you never intend to visit and otherwise have no business in that country, who cares? The difference is that the EU is not a banana republic (opinions may vary), and so many choose to respect and accept this their judgement in cases like this to stay on good terms.
- treis 8y ago
  >In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. That's not entirely true. You can go to a Canadian court to enforce an EU judgement against assets in Canada. So for example, if you cause a car accident in Germany, the plaintiff can sue you in Germany to get a judgement and then sue you in Canada to enforce that judgement. How Canadian (or US or otherwise) courts will treat a GDPR judgement remains to be seen, but it's not a guarantee that it won't be enforced.
adventured 8y ago
Your legal concept isn't valid. Hacker News can comply with GDPR today and choose not to comply the next day. They forfeit nothing in the process of selectively abandoning GDPR, in regards to being governed by US law and not EU law. If my company is located in the US and only governed by US jurisdiction (eg I do not operate in the EU in any manner), there's no such concept as admitting the EU has jurisdiction over my company and granting the EU new global powers (such that I can provide the EU jurisdictional reach into the US so that it overrules or competes with US law). That isn't my decision to make if I operate inside the US jurisdiction. The US solely decides jurisdiction within its zone of political control. That is, the US has the final say legally in all regards in that case. I could choose to voluntarily comply with GDPR, however the EU has zero power to force me to. I can flip flop back and forth a thousand times, or not, it makes no difference. If you ever find yourself wondering about these concepts, change the scenario to China. Under what scenario does the EU or US have power to dictate laws within China? None. It provides a perfect clarification every time. Nobody could possibly be confused about who is in charge of law within China.
- trothamel 8y ago
  I think we mostly agree, especially when you bring China into it. However, isn't the idea of forfeiting the personal jurisdiction defense? I am not a lawyer, but from what I understand, once you start debating the merits of the case, you waive the ability to claim that the court doesn't have jurisdiction. It seems like there's a bit of a chance of that here - once you admit the EU or Chinese legal system is the appropriate place to redress things, you've given up lack of jurisdiction as a defense.
  - zaarn 8y ago
    A GDPR Deletion Request is not a court case, it's a non-formal notification that you want someone to delete data about you. If someone follows that request and if the EU has jurisdiction are orthogonal issues; plenty of services offered deletion before the GDPR. The question of jurisdiction will come up if you ignore requests or otherwise violate the GDPR and a national agency that is responsible for handling violations contacts you. In which case you can still choose to ignore them, if you're not on EU soil, then it's up to the extradition or similar laws on what happens; the agency will likely file a court case (or you file), then the court will handle out the details with your national legal system; in most cases this means nationalizing any punishment. Ie, the court case will be handled and if you don't show up after being invited, will be ruled upon in your absence. Then the fine will be forwarded to your country where the courts in your country with your countries jursdiction will then collect it, probably take a fee and then forward the remainder back to the EU. An alternative outcome would be that the entire court case is moved into your country. Either way, complying to GDPR-related requests doesn't mean admitting jurisdiction of the EU; disagreeing the responsible government agencies involved is a good way to test if those have jurisdiction.
Symbiote 8y ago
I'd expect HN to be subject to the GDPR, since they show job adverts for startups in the EU on the front page.
- robdachshund 8y ago
  Yet they are not compliant and you cannot delete posts or accounts. Pretty sure YC does business in the EU as well. Enough to be subject to GDPR at least.

dleslie 8y ago

The hobbyists may not have access to do so. Perhaps their site is on a VPS or worse, a SAAS product? And why should a Canadian running a site on American servers have to fear EU law? Why isn't it the EU citizen's responsibility to know, understand and abide by the rules and regulations of the countries they're visiting online?

dmitriid 8y ago
Why should a European citizen abide by the laws of a different country (which may be illigal in their country BTW)
- trothamel 8y ago
  They shouldn't, but it's not their problem. If I, as the prince of Princeton, was to pass a law that each time one of my subjects visits your website, you must pay me $1, you'd think that's mad. And you'd be right - since you're not bound by Princeton laws. The EU is claiming that sites in other countries are bound by EU laws - and that's just as wrong as if Princeton passed the laws.
  - Semaphor 8y ago
    Countries (or conglomerates of them) applying their laws world-wide has long been what the US does on the internet. It's a bit too late to put that genie back in the bottle.
    - hnra 8y ago
      A website hosted outside of US jurisdiction will rarely get in trouble for breaking US specific laws.
      - robin_reala 8y ago
        But if the owners of that website visit the US they’re liable to be arrested (assuming the site has enough impact). Same in reverse.

belorn 8y ago

It is very doubtful there is any need to search posts. The data are still necessary for the purpose they were originally collected, and there is also a archiving exception which may apply. If I was them I would just send the person their login profile and delete that from the site. Everything else is excepted, including backups which are kept for security. A good community example to look at is Wikipedia. I will star to worry if and when I see them start deleting profiles and articles. Until then I see this kind of articles like a bit of scared interpretation of how nations might implement and apply GDPR.

atoav 8y ago
An article you agreed to publish on a public encyclopedia hardly counts as personal data..
- x0x0 8y ago
  Person B mentions person A by name or by nym. Person B describes person A without mentioning a name, eg by describing person A in a way which is recognizable. (eg the pilot that shot down the death star.) The first is at least searchable...
  - geocar 8y ago
    But neither are in scope. The GDPR makes exceptions for journalistic use cases (An encyclopedia certainly counts; see Article 85 and 89), and it does not require that you link a person (e.g. in your second case; see Recital 26) if you have no other reason to do. If someone persists, Article 11 makes it possible to put the onus on the person to identify any data in this category. - https://gdpr-info.eu/art-89-gdpr/ https://gdpr-info.eu/art-89-gdpr/ - https://gdpr-info.eu/art-85-gdpr/ https://gdpr-info.eu/art-85-gdpr/ - https://gdpr-info.eu/art-11-gdpr/ https://gdpr-info.eu/art-11-gdpr/ - https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/
x0x0 8y ago
data being necessary for original purpose doesn't help; you can withdraw consent

tokyodude 8y ago

> ThePhysicist: I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data of him/her left anyway. Deleting all posts in a forum by a certain user will not delete all posts in a forum by other users that quoted the user who desires to have their data deleted.

TheSpiceIsLife 8y ago
I'm not software expert by any means, but couldn't the deletion script also do a search for quoted text, at least sufficient to comply with the reasonable steps language of the legislation?
- soul_grafitti 8y ago
  > TheSpiceIsLife > I'm not software expert by any means, but couldn't the deletion script also do a search for quoted text, at least sufficient to comply with the reasonable steps language of the legislation? Devil meet details
hopler 8y ago
That's fine. A quote isn't the original speaker's data. It's the quoter's data.
- centering 8y ago
  Lol
- wutbrodo 8y ago
  I would assume so, but are you confident that the law unambiguously permits this? This isn't a rhetorical question, as I don't know a ton about the GDPR, but uncertainty is one of the worst forms of regulatory costs, so it's not really something you can wave off without knowing how it will be interpreted.
- tokyodude 8y ago
  By that argument google's index of data isn't the user's data it's google's but the right to be forgotten is specifically about deleting other people's copies of data about a person. In particular the NYTimes reports on Joe Baddy doing something bad. That article arguably belongs to the NYTimes. Google indexes that article with permission from NYTimes. Right to be forgotten requires Google remove the link to NYTimes even though neither Google's index nor the article at NYTimes belong to user.