21 ms·

Using GDPR to obtain one’s data as JSON

182 points by rostayob 5y ago

maxqin1 5y ago
It's sad that companies act so immorally that GDPR must exist. But I guess it's good this guy found yet another way to recover lost data?
- podgaj 5y ago
  Communist! /sarc
- rcMgD2BwE72F 5y ago
  In that regard, which law isn't sad?
  - maxqin1 5y ago
    Very true. But GDPR is pure annoyance. I wish they would 100X consequences of offenders and quit wasting development time on the worthless permission prompts.
    - kleiba 5y ago
      Permission prompts are the wrong way to approach a generally good feature. It would be much more useful if you could configure the permissions you want to give once and for all in your client (browser), and there would be a standard to communicate that transparently to the server. I keep making the same settings over and over again with different websites. That should not be necessary.
      - secondcoming 5y ago
        Having browser-wide permissions is actually allowed for if the constent string is stored in the consensu.org cookie. But website owners choose to use their own cookies.
      - pta2002 5y ago
        Meh, I want notifications on for whatsapp but I definitely don't want them on news sites. This is the wrong way to go about this IMO. Just a default, should definitely be overridable.
    - rcMgD2BwE72F 5y ago
      >GDPR is pure annoyance Is it? I'm the marketing manager of a European app publishers with around 5 millions active monthly users (and many times more if we account for the SDK that we license to other developers). We operates cloud services as part of our offering too. We find it very easy to comply with GDPR. As for me, I'm very glad as the end users to be protected by GDPR. I've had my data deleted or unpublished about a dozen times since the law has been enacted. And all the people around me are far more careful with how they share their data (and mine! e.g switching to Signal vs Facebook Messenger, or ProtonMail vs Gmail...).
- colaclanth 5y ago
  It's also sad that humans act so immorally that laws forbidding rape and murder must exist. Or maybe it's good that we can come together as a society and agree that these things are bad? Who knows
  - cycomanic 5y ago
    Well the big difference is that even without laws against rape and murder it is generally still a big exception. On the other hand tracking, carelessness with personal data, privacy violations etc. have been very much the norm with all companies (and arguably still are) even before the GDPR.
  - another_bear 5y ago
    More than two things can be bad at once. What is the point of this hot-take?
- simion314 5y ago
  >But I guess it's good this guy found yet another way to recover lost data? He wanted a backup he could control in case he loses his account, he gets banned or the company dies.
  - maxqin1 5y ago
    Is it mission critical? Sometimes a data loss can be quite liberating.
    - simion314 5y ago
      I am not the author, but it could be important (all your past TODO) even if is not life threatening. Also the service provided the active tasks as an export so same workflow could be copy-pasted and you update the SQL to include completed tasks too. The issue probably is that the priorities are different and implementing this would mean managers, designers and other "experts" would need to agree first.
- deleted 5y ago
  [deleted]
methyl 5y ago
> The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller IANAL, but this sounds to me like you are entitled to receive only the personal data of yours in a machine-readable format, not _everything_ you entered.
- malka 5y ago
  If it is a free text form, it's safer to assume that the data is personal.
  - kapep 5y ago
    Even timestamps can count as personal data. For example when they can be used to track working hours.
- chromanoid 5y ago
  > " and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided " puts this in context. Personal data is everything that is connected to the person requesting it.
  - that_guy_iain 5y ago
    I had GitHub claim my private git repos were not personal data. Because it was code, forgetting that my name and email are attached to every commit. Until there are massive fines for not following GDPR, it's pointless. GDPR was meant to be a serious threat and it is in some regards but it is ignored so many times with stuff like this and the fines honestly, aren't that much. I've seen GDPR violations result in no fine even after they admitted the violation in court.
    - chromanoid 5y ago
      As others stated, as long as data is associated with your account (regardless of what content) it is personal data. When companies like github.com do not follow the GDPR and do that notoriously I am sure the fines can be raised by the administrators without changing any laws. As you can see here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ there are actually some juicy fines already. I mean 50.000.000 EUR is not much for Google but still better than nothing considering "Insufficient legal basis for data processing" was not even a real issue before GDPR. BTW this is also a nice GDPR fine reason: "Insufficient technical and organisational measures to ensure information security" (e.g. British Airways was fined with 22 million). I never did that, but did file a complaint at your national Data Protection Authority? https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
SylvieLorxu 5y ago
I love this clause too. It's been making it possible to help people migrate to my app: https://github.com/TheLastProject/Catima/issues?q=is%3Aissue+label%3Aimport+ https://github.com/TheLastProject/Catima/issues?q=is%3Aissue... Of course I document my export format too so others can do the same with data from my app: https://github.com/TheLastProject/Catima/wiki/Export-format https://github.com/TheLastProject/Catima/wiki/Export-format :) The sad part is the allowed 30 days timeframe. Stocard really abuses this to make you wait as long for your data as they legally can make you wait: https://twitter.com/SylvieLorxu/status/1389343401435439112 https://twitter.com/SylvieLorxu/status/1389343401435439112
dsomers 5y ago
A bit of a tangent, but I think some people often criticize GDPR because it doesn’t have perfect enforcement, or some people are annoyed by the cookie banners. However, a positive aspect I don’t hear talked about enough is how it has had a chilling effect (in the most positive pro consumer way possible) I’ve noticed in my industry people are just much more careful about user data now, compared to it hardly being talked about before GDPR. Just the threat of those fines has scared C levels enough to put at least some engineering resources on privacy and security where there was much less before from my experience.
- chromanoid 5y ago
  I totally agree. I think the Cookie thing is also deliberately overblown. Useful cookies don't need consent (which are not used for tracking).
  - dkersten 5y ago
    Its also a different directive from GDPR, but people like to lump them together for maximum outrage.
  - zeorin 5y ago
    That's not accurate, at least as far as GDPR is concerned. Only necessary ones don't need consent, but the bar for "necessary" is high: the software wouldn't be able to function without it and there's no way to implement the software without it. Think: "address" is necessary for "delivery". Even then you still need consent to store the cookie under most versions of the "Cookie law", which is a complementary but different thing to GDPR.
    - chromanoid 5y ago
      Sure? https://www.iubenda.com/en/help/23672-gdpr-cookie-consent-cheatsheet https://www.iubenda.com/en/help/23672-gdpr-cookie-consent-ch... I would claim the only way to make a webapp with login securely function in a usable manner is to use a session cookie with secure transport policy. Do you really need more than that?
Tade0 5y ago
My favourite is still Art. 22, p. 1: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." Which means that if e.g. a bank declines your mortgage application based on a decision from a fully automated system you have a right to have a human being review it. Interestingly this made banks reluctant to use AI and helped with efforts in development of so-called "explainable AI".
- CalRobert 5y ago
  Just did exactly that with Avant. Could see where I was initially approved but then their manager said I was "still on contract" and quashed my application.
  - em-bee 5y ago
    doesn't sound like this worked in your favor, or did i get that wrong?
    - TeMPOraL 5y ago
      I read this as you do, but it's still a big win. If you make a machine learning model explain itself to humans, you open the possibility to challenge the model's conclusion. It's not just the question of whether the model does its math right - it also means we, as society, can say, "I see your math and it works out, but because $POLICY, you're not allowed to take these inputs into account". It means adding control points to a previously opaque process.
      - em-bee 5y ago
        you are right, and i absolutely agree. basing any decisions that substantially affect someone on machine learning alone should be illegal (even if it is the right decision)
    - CalRobert 5y ago
rygxqpbsngav 5y ago
Not entirely true. It hugely depends on the company. I have no luck retrieving even my personal info from some companies re. my interviews (I asked for internal email notes where I was the subject) and they simply denied providing almost nothing.Some even quoted GDPR as the reason in response stating the info I requested contains other people's details too. Some correctly provided info I asked redacting other peoples details which is fair. But there are so many exclusions to GDPR (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/the-right-to-be-informed/are-there-any-exceptions/ https://ico.org.uk/for-organisations/guide-to-data-protectio...) and the companies can use one or another exemption stated to ignore your request.
donatj 5y ago
Netflix’s GDPR dump was kind of painful to actually make use of. In particular I wanted to port my 15 years of ratings (over 1000 movies) to Letterboxd but the Netflix dump only gives title as the identifier of the media, and some titles are VERY indistinct. Any other information, anything else, like Year of movie would have helped. Instead I spent literal hours adjusting my data in Letterboxd’s fantastic import tool.
- madsbuch 5y ago
  This might be illegal. After all, the dump should contain your ratings of movies, which is not satisfied if you can not identify the movie.
  - MinorTom 5y ago
    The dump needs to contain the data that is associated with your user and unless they store "user has rated Minions (2015) with 5" they don't need to tell you that. (Quite the opposite - it would be illegal for them to do so unless they also tell you what they'Ve stored exactly the way they've stored it) Do note that nobody actually knows* if what I'm saying is true, but that's just another problem of GDPR
- M2Ys4U 5y ago
  If you're persistent you can get them to provide better data
  - donatj 5y ago
    I don't live in in the EU so I feel like that might be pushing my luck.
gregsadetsky 5y ago
I have a feeling that the unnamed todo service is Todoist. They offer a free plan, but backing up data requires a Pro plan which is really not ideal: https://todoist.com/help/articles/backups https://todoist.com/help/articles/backups I use the free plan, don’t reside in Europe, and recently wanted a backup. If you’re in the same boat, I recommend the following project — it has good documentation and immediately worked. https://github.com/darekkay/todoist-export https://github.com/darekkay/todoist-export
znpy 5y ago
I was just thinking about this. I've been delaying allowing whatsapp from sharing my data with facebook for a while now, but last news is that unless I give in to the extortion, I won't be allowed to send and receive messages to my contacts. I'm going to request all my data to Whatsapp using GDPR before switching all my conversations to Telegram, I guess.
- rostayob 5y ago
  This won't work with WhatsApp because since they do not store your messages in plaintext. I had to use some unofficial software ( https://www.wazzapmigrator.com/ https://www.wazzapmigrator.com/ ) to extract and store the messages from an unencrypted iPhone backup. Then you have everything in an sqlite file.
  - znpy 5y ago
    You're right indeed. I was just looking through my google drive and there's no trace of my whatsapp chat backups. Even after running another backup. And pages online confirm what you're saying. I guess I'll have to use my GDPR rights. Interestingly enough, there only is the possibility of exporting account information info, but the information page about that procedure explicitly says that messages are not included. That's relevant because since there's no other procedure to export data, this means that Whatsapp is already not okay with GDPR procedures. edit (2): I just sent an email to Whatsapp via their contact page (https://www.whatsapp.com/contact/?subject=messenger https://www.whatsapp.com/contact/?subject=messenger) asking for my data in accordance with GDPR. Let's see what happens.
    - aliher1911 5y ago
      Facebook doesn't hold your chat data. As soon as message reaches recipient(s) it is deleted. That's why Whatsapp nags you every year about making a google drive backup (it archives data from your phone to drive, not sends it from its servers to drive). So no GDPR could resurrect your chats and it is not violation because they don't have such data.
some1else 5y ago
YouTube will not give out data after suspending an account, which is likely a violation.
that_guy_iain 5y ago
I literally did this with GitHub they told me to get lost and go to court to force it through.
- tehbeard 5y ago
  I find it hard to believe they'd say so in that tone. That said, where does the GDPR stand when there is an API already in place that allows for data extraction?
  - that_guy_iain 5y ago
    It was more of less that tone, they accidentally send an internal memo to me. GDPR doesn't require me to become a user to get my data.
    - secondcoming 5y ago
      What data does github have about people who aren't users?
      - foepys 5y ago
        Somebody could make a GDPR request to find out.
        mytailorisrich 5y ago
        Where it gets tricky: 1. There would be entitled to ask for a form of ID in order to verify your identity. 2. Even if they are confident that you are really John Doe, how do they know that a mention of "John Doe" in all the data they have really means you, and not someone else? At some point it becomes too difficult and time-consuming so the easiest is to decline the request on the grounds of an exemption.
      - sigzero 5y ago
        I think he is referencing that sites collect data even if you aren't a user. In that case, you could use the GDPR to get that data. That scenario makes no sense with github though.
avh02 5y ago
since the author mentions whatsapp: What's the best strategy for exporting _all_ whatsapp messages on a device to a format that is readiable without whatsapp? - the export functionalities i've tried work with a message cap or other limitations. Otherwise, they involve emailing yourself conversations one at a time. I _think_ this is region dependent, but would like to hear from others.
- rostayob 5y ago
  I am the author -- I addressed this in another comment: https://news.ycombinator.com/item?id=27104896 https://news.ycombinator.com/item?id=27104896 .
- OJFord 5y ago
  I just replied to someone else about this [0] - the tl;dr is on Android at least you can grab its sqlite database unencrypted while the app's running. It's readable without WA, though obviously proprietary in the sense of the structure of it, but it is just sqlite, you can then dump it out however you want. [0] - https://news.ycombinator.com/item?id=27106454 https://news.ycombinator.com/item?id=27106454
jokoon 5y ago
I wrote my own comment fetcher for reddit, since there is a limit as data gets archived. I still managed to get all the 8 years of comments.
orasis 5y ago
This “one neat trick” means that some high level employee probably had to do it by hand. Making a request like this is a borderline unethical waste of someone’s time.
- driminicus 5y ago
  Unethical to use your right to access your data? Interesting take.
  - orasis 5y ago
    It’s your right in Europe. It’s offensive that some would expect a non-European organization to comply.
    - pawelkomarnicki 5y ago
      As long as company services customers from EU they have to comply and support their laws. This whole GDPR drama was caused in majority by huge American companies like Google and Facebook, doing whatever they like.
- squaresmile 5y ago
  I mean the company should automate this if this is wasting too much time.
- jillesvangurp 5y ago
  It puts companies on the spot to have internal tooling to deal with requests like this; which is not a bad thing. Nothing unethical about that; just the price of doing business. The mindset change that needs to happen in our industry is that companies should build this into their products by default. "Download my data" should be a feature that is simply planned and built. Just like "permanently delete my data" is not optional either. It's not even that hard to build mostly. It's only hard if it catches you by surprise, which these days is poor planning more than anything else. In Europe, and Germany especially, you can just expect people to do GDPR requests just because they can. We've had that happen right after GDPR became a thing. And you are legally required to be ready for that and respond in a timely fashion. If you want to do that manually, that's your problem. Small startups get a way with that. At some point it becomes annoying and you just fix it properly. Up to you when you do that.
wrboyce 5y ago
I did this to a bunch of companies a while ago now, the results were incredibly boring with the exception of eBay who delivered the data by posting a USB drive to my house.
barbarbar 5y ago
The title is misleading. It should be something like "machine readable format". Since the law does not specify json.
- rostayob 5y ago
  The title was edited by the mods -- the original title simply stated "GDPR -- A Success Story".
pawelkomarnicki 5y ago
This might work for data that is stored but another regulation enforces storage of only that data that you need — making it inefficient for backup restore (systems can just wipe your data and call it a day instead of soft-deleting it).

182 points by rostayob 5y ago

It's sad that companies act so immorally that GDPR must exist. But I guess it's good this guy found yet another way to recover lost data?

podgaj 5y ago
Communist! /sarc
rcMgD2BwE72F 5y ago
In that regard, which law isn't sad?
- maxqin1 5y ago
  Very true. But GDPR is pure annoyance. I wish they would 100X consequences of offenders and quit wasting development time on the worthless permission prompts.
  - kleiba 5y ago
    Permission prompts are the wrong way to approach a generally good feature. It would be much more useful if you could configure the permissions you want to give once and for all in your client (browser), and there would be a standard to communicate that transparently to the server. I keep making the same settings over and over again with different websites. That should not be necessary.
    - secondcoming 5y ago
      Having browser-wide permissions is actually allowed for if the constent string is stored in the consensu.org cookie. But website owners choose to use their own cookies.
    - pta2002 5y ago
      Meh, I want notifications on for whatsapp but I definitely don't want them on news sites. This is the wrong way to go about this IMO. Just a default, should definitely be overridable.
  - rcMgD2BwE72F 5y ago
    >GDPR is pure annoyance Is it? I'm the marketing manager of a European app publishers with around 5 millions active monthly users (and many times more if we account for the SDK that we license to other developers). We operates cloud services as part of our offering too. We find it very easy to comply with GDPR. As for me, I'm very glad as the end users to be protected by GDPR. I've had my data deleted or unpublished about a dozen times since the law has been enacted. And all the people around me are far more careful with how they share their data (and mine! e.g switching to Signal vs Facebook Messenger, or ProtonMail vs Gmail...).
colaclanth 5y ago
It's also sad that humans act so immorally that laws forbidding rape and murder must exist. Or maybe it's good that we can come together as a society and agree that these things are bad? Who knows
- cycomanic 5y ago
  Well the big difference is that even without laws against rape and murder it is generally still a big exception. On the other hand tracking, carelessness with personal data, privacy violations etc. have been very much the norm with all companies (and arguably still are) even before the GDPR.
- another_bear 5y ago
  More than two things can be bad at once. What is the point of this hot-take?
simion314 5y ago
>But I guess it's good this guy found yet another way to recover lost data? He wanted a backup he could control in case he loses his account, he gets banned or the company dies.
- maxqin1 5y ago
  Is it mission critical? Sometimes a data loss can be quite liberating.
  - simion314 5y ago
    I am not the author, but it could be important (all your past TODO) even if is not life threatening. Also the service provided the active tasks as an export so same workflow could be copy-pasted and you update the SQL to include completed tasks too. The issue probably is that the priorities are different and implementing this would mean managers, designers and other "experts" would need to agree first.
deleted 5y ago
[deleted]

methyl 5y ago

> The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller IANAL, but this sounds to me like you are entitled to receive only the personal data of yours in a machine-readable format, not _everything_ you entered.

malka 5y ago
If it is a free text form, it's safer to assume that the data is personal.
- kapep 5y ago
  Even timestamps can count as personal data. For example when they can be used to track working hours.
chromanoid 5y ago
> " and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided " puts this in context. Personal data is everything that is connected to the person requesting it.
- that_guy_iain 5y ago
  I had GitHub claim my private git repos were not personal data. Because it was code, forgetting that my name and email are attached to every commit. Until there are massive fines for not following GDPR, it's pointless. GDPR was meant to be a serious threat and it is in some regards but it is ignored so many times with stuff like this and the fines honestly, aren't that much. I've seen GDPR violations result in no fine even after they admitted the violation in court.
  - chromanoid 5y ago
    As others stated, as long as data is associated with your account (regardless of what content) it is personal data. When companies like github.com do not follow the GDPR and do that notoriously I am sure the fines can be raised by the administrators without changing any laws. As you can see here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ there are actually some juicy fines already. I mean 50.000.000 EUR is not much for Google but still better than nothing considering "Insufficient legal basis for data processing" was not even a real issue before GDPR. BTW this is also a nice GDPR fine reason: "Insufficient technical and organisational measures to ensure information security" (e.g. British Airways was fined with 22 million). I never did that, but did file a complaint at your national Data Protection Authority? https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

SylvieLorxu 5y ago

I love this clause too. It's been making it possible to help people migrate to my app: https://github.com/TheLastProject/Catima/issues?q=is%3Aissue+label%3Aimport+ https://github.com/TheLastProject/Catima/issues?q=is%3Aissue... Of course I document my export format too so others can do the same with data from my app: https://github.com/TheLastProject/Catima/wiki/Export-format https://github.com/TheLastProject/Catima/wiki/Export-format :) The sad part is the allowed 30 days timeframe. Stocard really abuses this to make you wait as long for your data as they legally can make you wait: https://twitter.com/SylvieLorxu/status/1389343401435439112 https://twitter.com/SylvieLorxu/status/1389343401435439112

dsomers 5y ago

A bit of a tangent, but I think some people often criticize GDPR because it doesn’t have perfect enforcement, or some people are annoyed by the cookie banners. However, a positive aspect I don’t hear talked about enough is how it has had a chilling effect (in the most positive pro consumer way possible) I’ve noticed in my industry people are just much more careful about user data now, compared to it hardly being talked about before GDPR. Just the threat of those fines has scared C levels enough to put at least some engineering resources on privacy and security where there was much less before from my experience.

chromanoid 5y ago
I totally agree. I think the Cookie thing is also deliberately overblown. Useful cookies don't need consent (which are not used for tracking).
- dkersten 5y ago
  Its also a different directive from GDPR, but people like to lump them together for maximum outrage.
- zeorin 5y ago
  That's not accurate, at least as far as GDPR is concerned. Only necessary ones don't need consent, but the bar for "necessary" is high: the software wouldn't be able to function without it and there's no way to implement the software without it. Think: "address" is necessary for "delivery". Even then you still need consent to store the cookie under most versions of the "Cookie law", which is a complementary but different thing to GDPR.
  - chromanoid 5y ago
    Sure? https://www.iubenda.com/en/help/23672-gdpr-cookie-consent-cheatsheet https://www.iubenda.com/en/help/23672-gdpr-cookie-consent-ch... I would claim the only way to make a webapp with login securely function in a usable manner is to use a session cookie with secure transport policy. Do you really need more than that?

Tade0 5y ago

My favourite is still Art. 22, p. 1: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." Which means that if e.g. a bank declines your mortgage application based on a decision from a fully automated system you have a right to have a human being review it. Interestingly this made banks reluctant to use AI and helped with efforts in development of so-called "explainable AI".

CalRobert 5y ago
Just did exactly that with Avant. Could see where I was initially approved but then their manager said I was "still on contract" and quashed my application.
- em-bee 5y ago
  doesn't sound like this worked in your favor, or did i get that wrong?
  - TeMPOraL 5y ago
    I read this as you do, but it's still a big win. If you make a machine learning model explain itself to humans, you open the possibility to challenge the model's conclusion. It's not just the question of whether the model does its math right - it also means we, as society, can say, "I see your math and it works out, but because $POLICY, you're not allowed to take these inputs into account". It means adding control points to a previously opaque process.
    - em-bee 5y ago
      you are right, and i absolutely agree. basing any decisions that substantially affect someone on machine learning alone should be illegal (even if it is the right decision)
  - CalRobert 5y ago

rygxqpbsngav 5y ago

Not entirely true. It hugely depends on the company. I have no luck retrieving even my personal info from some companies re. my interviews (I asked for internal email notes where I was the subject) and they simply denied providing almost nothing.Some even quoted GDPR as the reason in response stating the info I requested contains other people's details too. Some correctly provided info I asked redacting other peoples details which is fair. But there are so many exclusions to GDPR (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/the-right-to-be-informed/are-there-any-exceptions/ https://ico.org.uk/for-organisations/guide-to-data-protectio...) and the companies can use one or another exemption stated to ignore your request.

donatj 5y ago

Netflix’s GDPR dump was kind of painful to actually make use of. In particular I wanted to port my 15 years of ratings (over 1000 movies) to Letterboxd but the Netflix dump only gives title as the identifier of the media, and some titles are VERY indistinct. Any other information, anything else, like Year of movie would have helped. Instead I spent literal hours adjusting my data in Letterboxd’s fantastic import tool.

madsbuch 5y ago
This might be illegal. After all, the dump should contain your ratings of movies, which is not satisfied if you can not identify the movie.
- MinorTom 5y ago
  The dump needs to contain the data that is associated with your user and unless they store "user has rated Minions (2015) with 5" they don't need to tell you that. (Quite the opposite - it would be illegal for them to do so unless they also tell you what they'Ve stored exactly the way they've stored it) Do note that nobody actually knows* if what I'm saying is true, but that's just another problem of GDPR
M2Ys4U 5y ago
If you're persistent you can get them to provide better data
- donatj 5y ago
  I don't live in in the EU so I feel like that might be pushing my luck.

gregsadetsky 5y ago

I have a feeling that the unnamed todo service is Todoist. They offer a free plan, but backing up data requires a Pro plan which is really not ideal: https://todoist.com/help/articles/backups https://todoist.com/help/articles/backups I use the free plan, don’t reside in Europe, and recently wanted a backup. If you’re in the same boat, I recommend the following project — it has good documentation and immediately worked. https://github.com/darekkay/todoist-export https://github.com/darekkay/todoist-export

znpy 5y ago

I was just thinking about this. I've been delaying allowing whatsapp from sharing my data with facebook for a while now, but last news is that unless I give in to the extortion, I won't be allowed to send and receive messages to my contacts. I'm going to request all my data to Whatsapp using GDPR before switching all my conversations to Telegram, I guess.

rostayob 5y ago
This won't work with WhatsApp because since they do not store your messages in plaintext. I had to use some unofficial software ( https://www.wazzapmigrator.com/ https://www.wazzapmigrator.com/ ) to extract and store the messages from an unencrypted iPhone backup. Then you have everything in an sqlite file.
- znpy 5y ago
  You're right indeed. I was just looking through my google drive and there's no trace of my whatsapp chat backups. Even after running another backup. And pages online confirm what you're saying. I guess I'll have to use my GDPR rights. Interestingly enough, there only is the possibility of exporting account information info, but the information page about that procedure explicitly says that messages are not included. That's relevant because since there's no other procedure to export data, this means that Whatsapp is already not okay with GDPR procedures. edit (2): I just sent an email to Whatsapp via their contact page (https://www.whatsapp.com/contact/?subject=messenger https://www.whatsapp.com/contact/?subject=messenger) asking for my data in accordance with GDPR. Let's see what happens.
  - aliher1911 5y ago
    Facebook doesn't hold your chat data. As soon as message reaches recipient(s) it is deleted. That's why Whatsapp nags you every year about making a google drive backup (it archives data from your phone to drive, not sends it from its servers to drive). So no GDPR could resurrect your chats and it is not violation because they don't have such data.

some1else 5y ago

YouTube will not give out data after suspending an account, which is likely a violation.

that_guy_iain 5y ago

I literally did this with GitHub they told me to get lost and go to court to force it through.

tehbeard 5y ago
I find it hard to believe they'd say so in that tone. That said, where does the GDPR stand when there is an API already in place that allows for data extraction?
- that_guy_iain 5y ago
  It was more of less that tone, they accidentally send an internal memo to me. GDPR doesn't require me to become a user to get my data.
  - secondcoming 5y ago
    What data does github have about people who aren't users?
    - foepys 5y ago
      Somebody could make a GDPR request to find out.
      - mytailorisrich 5y ago
        Where it gets tricky: 1. There would be entitled to ask for a form of ID in order to verify your identity. 2. Even if they are confident that you are really John Doe, how do they know that a mention of "John Doe" in all the data they have really means you, and not someone else? At some point it becomes too difficult and time-consuming so the easiest is to decline the request on the grounds of an exemption.
    - sigzero 5y ago
      I think he is referencing that sites collect data even if you aren't a user. In that case, you could use the GDPR to get that data. That scenario makes no sense with github though.

avh02 5y ago

since the author mentions whatsapp: What's the best strategy for exporting _all_ whatsapp messages on a device to a format that is readiable without whatsapp? - the export functionalities i've tried work with a message cap or other limitations. Otherwise, they involve emailing yourself conversations one at a time. I _think_ this is region dependent, but would like to hear from others.

rostayob 5y ago
I am the author -- I addressed this in another comment: https://news.ycombinator.com/item?id=27104896 https://news.ycombinator.com/item?id=27104896 .
OJFord 5y ago
I just replied to someone else about this [0] - the tl;dr is on Android at least you can grab its sqlite database unencrypted while the app's running. It's readable without WA, though obviously proprietary in the sense of the structure of it, but it is just sqlite, you can then dump it out however you want. [0] - https://news.ycombinator.com/item?id=27106454 https://news.ycombinator.com/item?id=27106454

jokoon 5y ago

I wrote my own comment fetcher for reddit, since there is a limit as data gets archived. I still managed to get all the 8 years of comments.

orasis 5y ago

This “one neat trick” means that some high level employee probably had to do it by hand. Making a request like this is a borderline unethical waste of someone’s time.

driminicus 5y ago
Unethical to use your right to access your data? Interesting take.
- orasis 5y ago
  It’s your right in Europe. It’s offensive that some would expect a non-European organization to comply.
  - pawelkomarnicki 5y ago
    As long as company services customers from EU they have to comply and support their laws. This whole GDPR drama was caused in majority by huge American companies like Google and Facebook, doing whatever they like.
squaresmile 5y ago
I mean the company should automate this if this is wasting too much time.
jillesvangurp 5y ago
It puts companies on the spot to have internal tooling to deal with requests like this; which is not a bad thing. Nothing unethical about that; just the price of doing business. The mindset change that needs to happen in our industry is that companies should build this into their products by default. "Download my data" should be a feature that is simply planned and built. Just like "permanently delete my data" is not optional either. It's not even that hard to build mostly. It's only hard if it catches you by surprise, which these days is poor planning more than anything else. In Europe, and Germany especially, you can just expect people to do GDPR requests just because they can. We've had that happen right after GDPR became a thing. And you are legally required to be ready for that and respond in a timely fashion. If you want to do that manually, that's your problem. Small startups get a way with that. At some point it becomes annoying and you just fix it properly. Up to you when you do that.

wrboyce 5y ago

I did this to a bunch of companies a while ago now, the results were incredibly boring with the exception of eBay who delivered the data by posting a USB drive to my house.

barbarbar 5y ago

The title is misleading. It should be something like "machine readable format". Since the law does not specify json.

rostayob 5y ago
The title was edited by the mods -- the original title simply stated "GDPR -- A Success Story".

pawelkomarnicki 5y ago

This might work for data that is stored but another regulation enforces storage of only that data that you need — making it inefficient for backup restore (systems can just wipe your data and call it a day instead of soft-deleting it).