5 ms·

> The feature I most want from the Internet Archive The feature I most want from IA is a streamlined system to delete content they have archived on domains tha

> The feature I most want from the Internet Archive The feature I most want from IA is a streamlined system to delete content they have archived on domains that I own, including a proper privacy law compliance effort on their part. They have intentionally made it a difficult, manual process to get content removed. They operate as a de facto malicious crawler. They massively violate GDPR with how they operate and few seem to care about that fact, including all the commenters on HN (which universally give them a free pass on being malicious and violating GDPR very aggressively). When IA has to comply with laws like GDPR, that's the end of IA.

gojomo 5y ago
Shouldn't it be hard to delete things from a library and historical-archive? If you had to choose between the GDPR, & an accurate historical record, which would you prefer?
- Mezzie 5y ago
  We won't. Pretty much the only way things leave archives of record (which is what IA is trying to be) are through Acts of God (if the archive burns down/all of IA's servers are taken out in a mass alien EMP attack). An author suggesting that the LoC remove their copy of a book/other work (including digital works) because they want to unpublish it would not fly. The parent comment has an issue with anything on the Web not hidden in some way being considered 'public' and 'published', but that would be something that would require international cooperation to hash out.
pjc50 5y ago
> When IA has to comply with laws like GDPR, that's the end of IA. Will you be happy when you've burned down that library?
Mezzie 5y ago
I can't speak to GDPR specifically because I'm not European, but a fair amount of laws have leeway for preservation purposes. (For example, section 108 of the Copyright Act in the US functionally exempts archives from being punished for copying provided they are doing so for preservation purposes). There are very good reasons that archives will not destroy or alter information outside of very clear difficult and manual processes. And actually, looking at it, I don't think they're necessarily in violation of GDPR [0]. Point 3 says: "Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes." According to GDPR, national law of EU parties overrules GDPR when it comes to personal data being used in archival context. I don't know every EU country's stance, but most of the bigger economies would allow for this. There is also a difference between deleting the data and rendering it inaccessible to the public. Keeping something under wraps is generally more 'acceptable', but active destruction of the item (digital or not) and its providence is much more limited. Also there's a difference between personally identifying data (covered by GDPR), your content (which would be covered under copyright and not GDPR), and connections people can make if that content is available (not covered at all because it's not anybody else's issue if you write something terrible and people keep recognizing you over it so long as you did actually write it). [0] https://gdpr-info.eu/art-89-gdpr/ https://gdpr-info.eu/art-89-gdpr/
msla 5y ago
https://web.archive.org/web/20200813235643/http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr-wall/ https://web.archive.org/web/20200813235643/http://slawsonand... > Article 3(2), a new feature of the GDPR, creates extraterritorial jurisdiction over companies that have nothing but an internet presence in the EU and offer goods or services to EU residents[1]. While the GDPR requires these companies[2] to follow its data processing rules, it leaves the question of enforcement unanswered. Regulations that cannot be enforced do little to protect the personal data of EU citizens. > This article discusses how U.S. law affects the enforcement of Article 3(2). In reality, enforcing the GDPR on U.S. companies may be almost impossible. First, the U.S. prohibits enforcing of foreign-country fines. Thus, the EU enforcement power of fines for noncompliance is negligible. Second, enforcing the GDPR through the designated representative can be easily circumvented. Finally, a private lawsuit brought by in the EU may be impossible to enforce under U.S. law. [snip] > Currently, there is a hole in the GDPR wall that protects European Union personal data. Even with extraterritorial jurisdiction over U.S. companies with only an internet presence in the EU, the GDPR gives little in the way of tools to enforce it. Fines from supervisory authorities would be stopped by the prohibition on enforcing foreign fines. The company can evade enforcement through a representative simply by not designating one. Finally, private actions may be stalled on issues of personal jurisdiction. If a U.S. company completely disregards the GDPR while targeting customers in the EU, it can use the personal data of EU citizens without much fear of the consequences. While the extraterritorial jurisdiction created by Article 3(2) may have seemed like a good way to solve the problem of foreign companies who do not have a physical presence in the EU, it turns out to be practically useless.
deleted 5y ago
[deleted]

gojomo 5y ago

Shouldn't it be hard to delete things from a library and historical-archive? If you had to choose between the GDPR, & an accurate historical record, which would you prefer?

Mezzie 5y ago
We won't. Pretty much the only way things leave archives of record (which is what IA is trying to be) are through Acts of God (if the archive burns down/all of IA's servers are taken out in a mass alien EMP attack). An author suggesting that the LoC remove their copy of a book/other work (including digital works) because they want to unpublish it would not fly. The parent comment has an issue with anything on the Web not hidden in some way being considered 'public' and 'published', but that would be something that would require international cooperation to hash out.

pjc50 5y ago

> When IA has to comply with laws like GDPR, that's the end of IA. Will you be happy when you've burned down that library?

Mezzie 5y ago

I can't speak to GDPR specifically because I'm not European, but a fair amount of laws have leeway for preservation purposes. (For example, section 108 of the Copyright Act in the US functionally exempts archives from being punished for copying provided they are doing so for preservation purposes). There are very good reasons that archives will not destroy or alter information outside of very clear difficult and manual processes. And actually, looking at it, I don't think they're necessarily in violation of GDPR [0]. Point 3 says: "Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes." According to GDPR, national law of EU parties overrules GDPR when it comes to personal data being used in archival context. I don't know every EU country's stance, but most of the bigger economies would allow for this. There is also a difference between deleting the data and rendering it inaccessible to the public. Keeping something under wraps is generally more 'acceptable', but active destruction of the item (digital or not) and its providence is much more limited. Also there's a difference between personally identifying data (covered by GDPR), your content (which would be covered under copyright and not GDPR), and connections people can make if that content is available (not covered at all because it's not anybody else's issue if you write something terrible and people keep recognizing you over it so long as you did actually write it). [0] https://gdpr-info.eu/art-89-gdpr/ https://gdpr-info.eu/art-89-gdpr/

msla 5y ago

https://web.archive.org/web/20200813235643/http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr-wall/ https://web.archive.org/web/20200813235643/http://slawsonand... > Article 3(2), a new feature of the GDPR, creates extraterritorial jurisdiction over companies that have nothing but an internet presence in the EU and offer goods or services to EU residents[1]. While the GDPR requires these companies[2] to follow its data processing rules, it leaves the question of enforcement unanswered. Regulations that cannot be enforced do little to protect the personal data of EU citizens. > This article discusses how U.S. law affects the enforcement of Article 3(2). In reality, enforcing the GDPR on U.S. companies may be almost impossible. First, the U.S. prohibits enforcing of foreign-country fines. Thus, the EU enforcement power of fines for noncompliance is negligible. Second, enforcing the GDPR through the designated representative can be easily circumvented. Finally, a private lawsuit brought by in the EU may be impossible to enforce under U.S. law. [snip] > Currently, there is a hole in the GDPR wall that protects European Union personal data. Even with extraterritorial jurisdiction over U.S. companies with only an internet presence in the EU, the GDPR gives little in the way of tools to enforce it. Fines from supervisory authorities would be stopped by the prohibition on enforcing foreign fines. The company can evade enforcement through a representative simply by not designating one. Finally, private actions may be stalled on issues of personal jurisdiction. If a U.S. company completely disregards the GDPR while targeting customers in the EU, it can use the personal data of EU citizens without much fear of the consequences. While the extraterritorial jurisdiction created by Article 3(2) may have seemed like a good way to solve the problem of foreign companies who do not have a physical presence in the EU, it turns out to be practically useless.

deleted 5y ago

[deleted]