4 ms·

CCPA states: The right to know the personal information that businesses have collected from an individual The right to opt-out of the sale of consumer data

CCPA states: The right to know the personal information that businesses have collected from an individual The right to opt-out of the sale of consumer data collection The right to delete personal information collected from them HackerNews doesn't collect personal data. Deleting anything someone wants deleted isn't covered

whimsicalism 4y ago
Pretty sure it requires deleting comments if requested, this at least how my employer treats GDPr.
- jdminhbg 4y ago
  GDPR and CCPA are different laws from different countries.
  - whimsicalism 4y ago
    That's fair, at least at my employer we have simply rolled out GDPR compliance globally so we do not have to do deal with different jurisdictional compliance headaches as much.
- jahewson 4y ago
  Public comments really aren’t personal information.
  - kelnos 4y ago
    If they include personal information, then they absolutely are (a quick search for "GDPR user generated content" is enlightening). If I posted my full name and address in this comment, I believe a GDPR deletion request would indeed legally require HN to delete it (if I lived in the EU, that is, which I don't). And that's the problem: the vast majority of HN posts probably don't include personal information. But if someone were to submit a GDPR deletion request to HN, does HN really want to spend the time auditing perhaps hundreds or thousands of comments in order to determine what has personal information in it and what doesn't? And then also making a judgment as to whether the entire comment would need to be deleted, or if only part of it needed to be redacted? So I'd completely understand if HN would comply by deleting all comments. (I'm intentionally ignoring the fact that it's unclear if the EU could even enforce the GDPR against HN/YC, as I'm not sure if they have any business entities in the EU. Certainly the GDPR as written tries to be extraterritorial in its demands, but enforcement is another matter. HN/YC are of course subject to the CCPA, though.)
- kelnos 4y ago
  I think that depends on if comments contain any of your "personal information" (as defined by the GDPR). Certainly it's much easier (and safer) to just delete all of a user's comments than to audit each one and decide which comments have personal information and which don't, so I suspect that's why your employer (and many others, probably) take that route. But, for example, consider your post here that I'm replying to: I don't think anyone could credibly claim that it contains personal information. I believe HN will anonymize the username on past comments during account deletion (maybe only if requested, though?), so at least the comment wouldn't be attributed to anyone identifiable. But, of course, if someone posted their real name in a comment, or even just information that could identify them, that would be personal information in the comment body itself. Frankly I'm not a fan of the idea that comments on a public forum need to be deleted as a result of GDPR deletion requests. It would really suck if clicking on an old HN comment thread meant that you'd see a bunch of "[deleted due to GDPR request]" peppered all over the comment threads. Or think of a site like Stack Overflow: it would be a shame if a GDPR deletion request means that SO has to delete all a user's questions (which others may have spent time and effort answering!) and answers (that others would continue to benefit from reading). I think in this case the GDPR goes too far in making the site owner responsible. Sure, a site owner should absolutely be responsible for personal information it asks for and intentionally collects, but it seems a bit unfair to extend that to information a user may voluntarily submit, in a context where the submission is free-form and unstructured. Then again, I'm -- perhaps hypocritically -- of the opinion that sites like Facebook should be required to delete all posts and content when someone wants to delete their account. Back when I used it, I'd definitely run into some old post comments where some comments have been deleted (due to account closures), which really confuses the conversation going on in the comments. For some reason my heart is trying to tell me that FB and HN are somehow different here, even though I can't logically support that. I think my feeling is that stuff I post on HN belongs to the community, whereas stuff I (used to) post on FB still belongs to me. Not sure why there should be that difference, though.
ceejayoz 4y ago
> HackerNews doesn't collect personal data. There's an email field in the settings.
- iceburgcrm 4y ago
  Optional and used for recovery purposes and it is self serve for removal and immediately removed
  - ceejayoz 4y ago
    None of that makes it non-PII.

whimsicalism 4y ago

Pretty sure it requires deleting comments if requested, this at least how my employer treats GDPr.

jdminhbg 4y ago
GDPR and CCPA are different laws from different countries.
- whimsicalism 4y ago
  That's fair, at least at my employer we have simply rolled out GDPR compliance globally so we do not have to do deal with different jurisdictional compliance headaches as much.
jahewson 4y ago
Public comments really aren’t personal information.
- kelnos 4y ago
  If they include personal information, then they absolutely are (a quick search for "GDPR user generated content" is enlightening). If I posted my full name and address in this comment, I believe a GDPR deletion request would indeed legally require HN to delete it (if I lived in the EU, that is, which I don't). And that's the problem: the vast majority of HN posts probably don't include personal information. But if someone were to submit a GDPR deletion request to HN, does HN really want to spend the time auditing perhaps hundreds or thousands of comments in order to determine what has personal information in it and what doesn't? And then also making a judgment as to whether the entire comment would need to be deleted, or if only part of it needed to be redacted? So I'd completely understand if HN would comply by deleting all comments. (I'm intentionally ignoring the fact that it's unclear if the EU could even enforce the GDPR against HN/YC, as I'm not sure if they have any business entities in the EU. Certainly the GDPR as written tries to be extraterritorial in its demands, but enforcement is another matter. HN/YC are of course subject to the CCPA, though.)
kelnos 4y ago
I think that depends on if comments contain any of your "personal information" (as defined by the GDPR). Certainly it's much easier (and safer) to just delete all of a user's comments than to audit each one and decide which comments have personal information and which don't, so I suspect that's why your employer (and many others, probably) take that route. But, for example, consider your post here that I'm replying to: I don't think anyone could credibly claim that it contains personal information. I believe HN will anonymize the username on past comments during account deletion (maybe only if requested, though?), so at least the comment wouldn't be attributed to anyone identifiable. But, of course, if someone posted their real name in a comment, or even just information that could identify them, that would be personal information in the comment body itself. Frankly I'm not a fan of the idea that comments on a public forum need to be deleted as a result of GDPR deletion requests. It would really suck if clicking on an old HN comment thread meant that you'd see a bunch of "[deleted due to GDPR request]" peppered all over the comment threads. Or think of a site like Stack Overflow: it would be a shame if a GDPR deletion request means that SO has to delete all a user's questions (which others may have spent time and effort answering!) and answers (that others would continue to benefit from reading). I think in this case the GDPR goes too far in making the site owner responsible. Sure, a site owner should absolutely be responsible for personal information it asks for and intentionally collects, but it seems a bit unfair to extend that to information a user may voluntarily submit, in a context where the submission is free-form and unstructured. Then again, I'm -- perhaps hypocritically -- of the opinion that sites like Facebook should be required to delete all posts and content when someone wants to delete their account. Back when I used it, I'd definitely run into some old post comments where some comments have been deleted (due to account closures), which really confuses the conversation going on in the comments. For some reason my heart is trying to tell me that FB and HN are somehow different here, even though I can't logically support that. I think my feeling is that stuff I post on HN belongs to the community, whereas stuff I (used to) post on FB still belongs to me. Not sure why there should be that difference, though.

ceejayoz 4y ago

> HackerNews doesn't collect personal data. There's an email field in the settings.

iceburgcrm 4y ago
Optional and used for recovery purposes and it is self serve for removal and immediately removed
- ceejayoz 4y ago
  None of that makes it non-PII.