5 ms·

Ask HN: Is HN GDPR Compliant?

brudgers 6y ago
There is a |legal| link below.
- searchableguy 6y ago
  I know. I did go through it. It mentions California privacy acts under which you can request to have your information deleted but nothing for GDPR or europe and I have asked for questions related to deleting - of which I was told they don't do this for whole accounts but renaming is fine so I am assuming that's how they anonymize. I am not a lawyer so I don't know even if I went through the privacy policy hence simplifying the question like above.
  - brudgers 6y ago
    If it really matters, hire a lawyer because that's the only way to determine if compliance is even relevant. And until a finder of fact makes a determination, the question is still up in the air irrespective of what a lawyer might say.
Someone 6y ago
No. I easily found examples of non-compliance: https://www.ycombinator.com/legal https://www.ycombinator.com/legal: “Please note that we reserve the right to refuse to (i) delete any of the submissions, favorites, or comments you post on the Site or link in your profile or (ii) remove their association with your profile or username” This conflicts with https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/: “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:” There also is no export option, as required by https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/: “The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format“
- y42 6y ago
  Not that easy. If any of the above mentioned information is not "personal data", it's not GDPR relevant. Also GDPR does not require an "export option" to export data ad hoc. The site owner must provide personal (!) data upon request.

There is a |legal| link below.

searchableguy 6y ago
I know. I did go through it. It mentions California privacy acts under which you can request to have your information deleted but nothing for GDPR or europe and I have asked for questions related to deleting - of which I was told they don't do this for whole accounts but renaming is fine so I am assuming that's how they anonymize. I am not a lawyer so I don't know even if I went through the privacy policy hence simplifying the question like above.
- brudgers 6y ago
  If it really matters, hire a lawyer because that's the only way to determine if compliance is even relevant. And until a finder of fact makes a determination, the question is still up in the air irrespective of what a lawyer might say.

No. I easily found examples of non-compliance: https://www.ycombinator.com/legal https://www.ycombinator.com/legal: “Please note that we reserve the right to refuse to (i) delete any of the submissions, favorites, or comments you post on the Site or link in your profile or (ii) remove their association with your profile or username” This conflicts with https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/: “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:” There also is no export option, as required by https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/: “The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format“

y42 6y ago
Not that easy. If any of the above mentioned information is not "personal data", it's not GDPR relevant. Also GDPR does not require an "export option" to export data ad hoc. The site owner must provide personal (!) data upon request.