5 ms·

That may be true, but I believe the information hackernews collects is still enough to be potentially personally identifiable. This makes we wonder if the inabi

That may be true, but I believe the information hackernews collects is still enough to be potentially personally identifiable. This makes we wonder if the inability to delete here might be at odds with GDPR compliance in the EU.

widforss 7y ago
But YC probably have no ties to the EU, so they can't be held accountable.
- nathankleyn 7y ago
  GDPR applies to any company that handles the data of EU citizens, regardless of whether that company is located in the EU or not.
  - hdkrgr 7y ago
    EU citizens OR residents
  - whereistimbo 7y ago
    What happen if the non-EU company won't comply? Can EU sue it? Or block its website?
  - tzs 7y ago
    GDPR has little or nothing to do with citizenship. It focuses on presence in the EU, not on citizenship in the EU. See Article 3. It applies to: 1. Processing that takes place in the context of processors and controllers that are in the Union, regardless of whether or not the processing itself takes place in the Union. 2. Processing the data of subjects who are in the Union by controllers or processors who are not in the Union if the processing is related to offering goods or services to such subjects in the Union or the processing is related to monitoring the behavior of such subjects that takes place in the Union. One of the recital elaborates on offering goods or services to subjects in the Union, and that includes this: > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. I'd guess that HN would argue that they are not in the Union, so don't fall under #1, and not monitoring behavior, so don't fall under the second prong of #2, and that they did not envisage offering goods and services to people in the Union, getting them out of the first prong of #2.
  - msla 7y ago
    The GDPR only applies to entities it can be enforced against. There's a whole world outside of Europe, which does not follow European law.
    - jnordwick 7y ago
      There was a post maybe a year ago about GDPR, and the general feeling on HN was the all websites should follow it in principle even if not required by law. I guess that means all sites, except HN.
concerned_user 7y ago
I think you are mixing up right to be forgotten, and GDPR here a bit. Excuse me, but what information are you referring to? user: 0xfffafaCrash created: October 6, 2014 karma: 203 This information? That was all I, as a fellow user, could see. Rest of the information is not public. GDPR is about personal data and extra data (metadata) that is used for non-essential business needs like marketing, so user can ask to remove that extra data. But if the data is required for the entity to do business and by law you can't expect it to be deleted. Like you can't demand some e-commerce site to delete all your order information and associated delivery addresses, phones, contacts, you can however ask them to remove the account, so you lose access to orders and they in theory can't associate it with you anymore, or at least use to build profile on what your buying habits are. So you can't demand (under GDPR) from HN to remove your data, maybe remove account but handle is not personal data so it is a stretch.
- tobr 7y ago
  Wait, what? You can go back and see all their comments and submissions. That will quite possibly have a lot of PII, but cannot normally be deleted. FWIW, this is something HN has to fix, if you ask me.
  - jefftk 7y ago
    If you send a request to the moderators and cite the GDPR I would expect them to delete it. The GDPR doesn't require the deletion process to be automated.
    - tobr 7y ago
      So I guess the Just Delete Me link should be mailto:hn@ycombinator.com?subject=Please%20GDPR%20my%20account
      - jefftk 7y ago
        That sounds more accurate than "impossible" does to me
freeflight 7y ago
> That may be true, but I believe the information hackernews collects is still enough to be potentially personally identifiable. Imho there's still a massive difference between "potentially personally identifiable" and running a whole business on identifying people and selling that information as Facebook or Google does. Reddit is a weird middle-ground: Afaik they don't make a business out of selling ad targeting profiles as Facebook or Google do. But due to Reddit's nature with subreddits for even the weirdest of interests, they do have massive potential for it. In the big picture, subreddits are not that different to Facebook groups surfacing preferences on all kinds of topics, thus analyzing a Reddit users post history [0] and subreddit preferences (u/leansbot) can also give quite a good profile about somebody. HN couldn't even compete with that if it tried, HN is pretty much just one big main forum where certain topics simply don't get discussed, as such users don't even have the opportunity to surface personal preferences about them, compromising their own privacy. [0] https://atomiks.github.io/reddit-user-analyser/ https://atomiks.github.io/reddit-user-analyser/

widforss 7y ago

But YC probably have no ties to the EU, so they can't be held accountable.

nathankleyn 7y ago
GDPR applies to any company that handles the data of EU citizens, regardless of whether that company is located in the EU or not.
- hdkrgr 7y ago
  EU citizens OR residents
- whereistimbo 7y ago
  What happen if the non-EU company won't comply? Can EU sue it? Or block its website?
- tzs 7y ago
  GDPR has little or nothing to do with citizenship. It focuses on presence in the EU, not on citizenship in the EU. See Article 3. It applies to: 1. Processing that takes place in the context of processors and controllers that are in the Union, regardless of whether or not the processing itself takes place in the Union. 2. Processing the data of subjects who are in the Union by controllers or processors who are not in the Union if the processing is related to offering goods or services to such subjects in the Union or the processing is related to monitoring the behavior of such subjects that takes place in the Union. One of the recital elaborates on offering goods or services to subjects in the Union, and that includes this: > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. I'd guess that HN would argue that they are not in the Union, so don't fall under #1, and not monitoring behavior, so don't fall under the second prong of #2, and that they did not envisage offering goods and services to people in the Union, getting them out of the first prong of #2.
- msla 7y ago
  The GDPR only applies to entities it can be enforced against. There's a whole world outside of Europe, which does not follow European law.
  - jnordwick 7y ago
    There was a post maybe a year ago about GDPR, and the general feeling on HN was the all websites should follow it in principle even if not required by law. I guess that means all sites, except HN.

concerned_user 7y ago

I think you are mixing up right to be forgotten, and GDPR here a bit. Excuse me, but what information are you referring to? user: 0xfffafaCrash created: October 6, 2014 karma: 203 This information? That was all I, as a fellow user, could see. Rest of the information is not public. GDPR is about personal data and extra data (metadata) that is used for non-essential business needs like marketing, so user can ask to remove that extra data. But if the data is required for the entity to do business and by law you can't expect it to be deleted. Like you can't demand some e-commerce site to delete all your order information and associated delivery addresses, phones, contacts, you can however ask them to remove the account, so you lose access to orders and they in theory can't associate it with you anymore, or at least use to build profile on what your buying habits are. So you can't demand (under GDPR) from HN to remove your data, maybe remove account but handle is not personal data so it is a stretch.

tobr 7y ago
Wait, what? You can go back and see all their comments and submissions. That will quite possibly have a lot of PII, but cannot normally be deleted. FWIW, this is something HN has to fix, if you ask me.
- jefftk 7y ago
  If you send a request to the moderators and cite the GDPR I would expect them to delete it. The GDPR doesn't require the deletion process to be automated.
  - tobr 7y ago
    So I guess the Just Delete Me link should be mailto:hn@ycombinator.com?subject=Please%20GDPR%20my%20account
    - jefftk 7y ago
      That sounds more accurate than "impossible" does to me

freeflight 7y ago

> That may be true, but I believe the information hackernews collects is still enough to be potentially personally identifiable. Imho there's still a massive difference between "potentially personally identifiable" and running a whole business on identifying people and selling that information as Facebook or Google does. Reddit is a weird middle-ground: Afaik they don't make a business out of selling ad targeting profiles as Facebook or Google do. But due to Reddit's nature with subreddits for even the weirdest of interests, they do have massive potential for it. In the big picture, subreddits are not that different to Facebook groups surfacing preferences on all kinds of topics, thus analyzing a Reddit users post history [0] and subreddit preferences (u/leansbot) can also give quite a good profile about somebody. HN couldn't even compete with that if it tried, HN is pretty much just one big main forum where certain topics simply don't get discussed, as such users don't even have the opportunity to surface personal preferences about them, compromising their own privacy. [0] https://atomiks.github.io/reddit-user-analyser/ https://atomiks.github.io/reddit-user-analyser/