4 ms·

If HN stores IP addresses or does any sort of de-anonymization on their end, then probably yes. They cover this in their privacy policy, at least for California

If HN stores IP addresses or does any sort of de-anonymization on their end, then probably yes. They cover this in their privacy policy, at least for California [1], but their terms of use (right to refuse deletion) seem inconsistent with CCPA. Also, if they don't store IP or actively deident, then I'm not sure either reg applies. HN isn't collecting PII. Just because you chose to type some info into a free form text box doesn't mean that the are liable for treating that data as PII, unless they're doing the tagging and extraction themselves or you inform them you're in CA/EU and the post contains PII. ianal. [1] https://www.ycombinator.com/legal/#calprivacy https://www.ycombinator.com/legal/#calprivacy

parker_mountain 4y ago
.
- Shank 4y ago
  GDPR PII is defined as such: > ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (Article 4)
- thwayunion 4y ago
  > Any free-form field must be treated as PII. I've definitely never received this advice. I think your DPO/counsel are being excessively risk-averse, but IANA(EU)L.
- lol768 4y ago
  Nonsense. If you're made aware you're storing PII, fine. That's different. If it's a field designed for something else, and you have no knowledge it's being used to store PII? You're not going to get a penalty for that. This isn't American law, where everything seems to be decided based on technicalities and the exact wording of the law. These decisions are made by reasonable human beings who review the facts of the situation and come to a judgement.
deleted 4y ago
[deleted]

parker_mountain 4y ago

Shank 4y ago
GDPR PII is defined as such: > ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (Article 4)
thwayunion 4y ago
> Any free-form field must be treated as PII. I've definitely never received this advice. I think your DPO/counsel are being excessively risk-averse, but IANA(EU)L.
lol768 4y ago
Nonsense. If you're made aware you're storing PII, fine. That's different. If it's a field designed for something else, and you have no knowledge it's being used to store PII? You're not going to get a penalty for that. This isn't American law, where everything seems to be decided based on technicalities and the exact wording of the law. These decisions are made by reasonable human beings who review the facts of the situation and come to a judgement.

deleted 4y ago

[deleted]