7 ms·

where can I download my HN's data?

notRobot 5y ago
You can't. There's also no easy way to request all profile data deletion, unfortunately. However, they do respond to privacy requests, see: https://news.ycombinator.com/item?id=26959559 https://news.ycombinator.com/item?id=26959559 https://news.ycombinator.com/item?id=26410165 https://news.ycombinator.com/item?id=26410165
- capableweb 5y ago
  Have you tried emailing hn@ycombinator.com and it got denied? Or what you mean there is no easy way to request the data deletion? AFAIK they don't scrub the comments but if you request it, your username will be replaced with [deleted] for all your comments.
  - murphy1312 5y ago
    that is by no means an easy way. easy would be a button on the profile page for example.
    - capableweb 5y ago
      Ah well, I guess "easy" is relative. I'm sure if you send them one email, they'll confirm it with you once within a month and then delete the data. Compare that to Coinbase, which has forms, buttons and seems it's mostly an automated process instead of manual email, but I've tried getting Coinbase to delete my account + data for over 6 months now to no avail, multiple emails back and forward where they confirm the deletion, say it's in progress, I email back after a month and they ask me to confirm the deletion again. So even with a button, doesn't mean the process is easy, and there is also a lot more to consider than just how you initially the request.
      - newswasboring 5y ago
        I have sent such emails for a previous account, the emails were ignored.
      - hungryforcodes 5y ago
        Mind you, Coinbase probably has an obligation to keep your data for x number of years for both tax and auditing purposes.
      - Buttons840 5y ago
        This is such a grey area. Do emails others sent to me belong to them? Do my HN comments make the entire conversation partially mine? If one of my comments is "well said", and the parent deletes their comment, is not my comment diminished? What do we do about quotes? Etc.
        capableweb 5y ago
        Solved problem already: Hash the username + a salt and change that everywhere. Every comment is from a unique author + the comment body is still there + all the replies are still there but, author name has been removed.
        Buttons840 5y ago
        That's a decent solution. But I think simply replacing the usernames with [deleted] is better. It leaves the comment but detaches the user and breaks the link between all the users comments.
        capableweb 5y ago
        It becomes very hard to track conversations with N+2 users though, if more than one has the [deleted] username. Hence the hashing to get a unique [deleted] username for each user.
        kuschku 5y ago
        That's not legal either. If the comment body contains personal information anywhere, GDPR also applies to it.
  - kjakm 5y ago
    I remember trying that with an old account a few years ago (suggesting your solution of just hiding the username) and was denied. Maybe things have changed since then though.
vincnetas 5y ago
There is public API for HN data https://github.com/HackerNews/API https://github.com/HackerNews/API Does it count like ability to download your data?
- user-the-name 5y ago
  No. It needs to be accessible to everyone, not just to programmers with lots of free time.
capableweb 5y ago
Last time I "archived" my account data on HN I used https://github.com/HackerNews/API https://github.com/HackerNews/API which seems to be working good enough for my needs.
deleted 5y ago
[deleted]
thatguy0900 5y ago
Hn has no EU presence so doesn't have to follow EU laws, no? Or do they have to ip block Europeans? What would the EU actually do to hn if they did decide to enforce the rules here?
- burntoutfire 5y ago
  Typical approach is issue a fine and then seize the assets in the EU that belong to HN's owners (if there are any).
- tremon 5y ago
  Indeed, my answer would be no. But IANAL, IANYL and TINLA. There's https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/ : > Article 3.2 goes even further and applies the law to organizations that are not in the EU if two conditions are met: the organization offers goods or services to people in the EU, or the organization monitors their online behavior. Recital 23 clarifies what is meant by the organization offers goods or services to people in the EU: https://gdpr.eu/Recital-23-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-targeted https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta... > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, [..] the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. Profiling is clarified in recital 24: https://gdpr.eu/Recital-24-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-profiled/ https://gdpr.eu/Recital-24-Applicable-to-processors-not-esta... > it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. So, I'd say no. The mere fact that HN is accessible to people in the EU does not show intent. HN is an English forum, which is the native language of the country where it is established, and does not offer its services in additional European languages, and does not advertise products in the Euro currency. I'm unable to know for sure, but I don't believe HN is using my posts here to predict or analyse my personal preferences either.
dahart 5y ago
Question: are you an EU citizen, and is there any way for HN to know whether you are an EU citizen? (Your public profile page has no personally identifiable information.) GDPR is an EU law that applies to sites that market directly to EU citizens. How and whether it applies to sites outside the EU has been debated. GDPR can prevent a site from operating in the EU. But GDPR does not apply to a US citizen using a US-run web site. https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Applicability_outside_of_the_European_Union https://en.wikipedia.org/wiki/General_Data_Protection_Regula... https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ Edit: speaking of personally identifiable information, GDPR defines the information that is subject to download as “personal” information, only when it can be identified. Do you have data on HN servers that is subject to GDPR even if you live in the EU? (I don’t think I do.) See 4.1: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- pbhjpbhj 5y ago
  Most people have an email address on their profile, that's PII. One could post one's name, that's definitely PII and AIUI that affects all the data then on the site, as it's now associated.
  - dahart 5y ago
    Are you sure forum comments can count as PII, according to GDPR definitions?
    - deleted 5y ago
      [deleted]
    - M2Ys4U 5y ago
      Article 4(1) of the GDPR states the relevant definition: "Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person". That should be read in light of the recitals, for instance recital 26: "The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes." From these I think it should be obvious that forum comments may be (and even probably are) considered to be personal data under the GDPR.

You can't. There's also no easy way to request all profile data deletion, unfortunately. However, they do respond to privacy requests, see: https://news.ycombinator.com/item?id=26959559 https://news.ycombinator.com/item?id=26959559 https://news.ycombinator.com/item?id=26410165 https://news.ycombinator.com/item?id=26410165

capableweb 5y ago
Have you tried emailing hn@ycombinator.com and it got denied? Or what you mean there is no easy way to request the data deletion? AFAIK they don't scrub the comments but if you request it, your username will be replaced with [deleted] for all your comments.
- murphy1312 5y ago
  that is by no means an easy way. easy would be a button on the profile page for example.
  - capableweb 5y ago
    Ah well, I guess "easy" is relative. I'm sure if you send them one email, they'll confirm it with you once within a month and then delete the data. Compare that to Coinbase, which has forms, buttons and seems it's mostly an automated process instead of manual email, but I've tried getting Coinbase to delete my account + data for over 6 months now to no avail, multiple emails back and forward where they confirm the deletion, say it's in progress, I email back after a month and they ask me to confirm the deletion again. So even with a button, doesn't mean the process is easy, and there is also a lot more to consider than just how you initially the request.
    - newswasboring 5y ago
      I have sent such emails for a previous account, the emails were ignored.
    - hungryforcodes 5y ago
      Mind you, Coinbase probably has an obligation to keep your data for x number of years for both tax and auditing purposes.
    - Buttons840 5y ago
      This is such a grey area. Do emails others sent to me belong to them? Do my HN comments make the entire conversation partially mine? If one of my comments is "well said", and the parent deletes their comment, is not my comment diminished? What do we do about quotes? Etc.
      - capableweb 5y ago
        Solved problem already: Hash the username + a salt and change that everywhere. Every comment is from a unique author + the comment body is still there + all the replies are still there but, author name has been removed.
        Buttons840 5y ago
        That's a decent solution. But I think simply replacing the usernames with [deleted] is better. It leaves the comment but detaches the user and breaks the link between all the users comments.
        capableweb 5y ago
        It becomes very hard to track conversations with N+2 users though, if more than one has the [deleted] username. Hence the hashing to get a unique [deleted] username for each user.
        kuschku 5y ago
        That's not legal either. If the comment body contains personal information anywhere, GDPR also applies to it.
- kjakm 5y ago
  I remember trying that with an old account a few years ago (suggesting your solution of just hiding the username) and was denied. Maybe things have changed since then though.

vincnetas 5y ago

There is public API for HN data https://github.com/HackerNews/API https://github.com/HackerNews/API Does it count like ability to download your data?

user-the-name 5y ago
No. It needs to be accessible to everyone, not just to programmers with lots of free time.

capableweb 5y ago

Last time I "archived" my account data on HN I used https://github.com/HackerNews/API https://github.com/HackerNews/API which seems to be working good enough for my needs.

deleted 5y ago

[deleted]

thatguy0900 5y ago

Hn has no EU presence so doesn't have to follow EU laws, no? Or do they have to ip block Europeans? What would the EU actually do to hn if they did decide to enforce the rules here?

burntoutfire 5y ago
Typical approach is issue a fine and then seize the assets in the EU that belong to HN's owners (if there are any).
tremon 5y ago
Indeed, my answer would be no. But IANAL, IANYL and TINLA. There's https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/ : > Article 3.2 goes even further and applies the law to organizations that are not in the EU if two conditions are met: the organization offers goods or services to people in the EU, or the organization monitors their online behavior. Recital 23 clarifies what is meant by the organization offers goods or services to people in the EU: https://gdpr.eu/Recital-23-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-targeted https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta... > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, [..] the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. Profiling is clarified in recital 24: https://gdpr.eu/Recital-24-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-profiled/ https://gdpr.eu/Recital-24-Applicable-to-processors-not-esta... > it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. So, I'd say no. The mere fact that HN is accessible to people in the EU does not show intent. HN is an English forum, which is the native language of the country where it is established, and does not offer its services in additional European languages, and does not advertise products in the Euro currency. I'm unable to know for sure, but I don't believe HN is using my posts here to predict or analyse my personal preferences either.

dahart 5y ago

Question: are you an EU citizen, and is there any way for HN to know whether you are an EU citizen? (Your public profile page has no personally identifiable information.) GDPR is an EU law that applies to sites that market directly to EU citizens. How and whether it applies to sites outside the EU has been debated. GDPR can prevent a site from operating in the EU. But GDPR does not apply to a US citizen using a US-run web site. https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Applicability_outside_of_the_European_Union https://en.wikipedia.org/wiki/General_Data_Protection_Regula... https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ Edit: speaking of personally identifiable information, GDPR defines the information that is subject to download as “personal” information, only when it can be identified. Do you have data on HN servers that is subject to GDPR even if you live in the EU? (I don’t think I do.) See 4.1: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/

pbhjpbhj 5y ago
Most people have an email address on their profile, that's PII. One could post one's name, that's definitely PII and AIUI that affects all the data then on the site, as it's now associated.
- dahart 5y ago
  Are you sure forum comments can count as PII, according to GDPR definitions?
  - deleted 5y ago
    [deleted]
  - M2Ys4U 5y ago
    Article 4(1) of the GDPR states the relevant definition: "Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person". That should be read in light of the recitals, for instance recital 26: "The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes." From these I think it should be obvious that forum comments may be (and even probably are) considered to be personal data under the GDPR.