5 ms·

To my understanding they would still be GDPR-compliant if they delete your data upon receiving an email that you would like to exercise this right under GDPR, e

To my understanding they would still be GDPR-compliant if they delete your data upon receiving an email that you would like to exercise this right under GDPR, even if they don't automate that process but IANAL. Perhaps someone can confirm whether this has in fact worked for them in the past.

ldjb 4y ago
Although many large websites and services allow you to request erasure of your data in an automated way, this is not required by GDPR. GDPR allows individuals to request erasure verbally or in writing, and the data controller than has one month to respond.
pifm_guy 4y ago
There is no requirement to automate GDPR requests. However all organisations must be able to handle GDPR requests via any communication channel. Eg. They need to treat a data deletion request sent via twitter DM as a valid request if they have an official Twitter presence. It is insufficient to require the customer fill out a special web form.
- misnome 4y ago
  Isn’t it all organisations _that do business_ in the EU? Since this is a free forum with no paid features, I wonder if it would be excluded?
  - chriswait 4y ago
    IANAL but I don't think it matters whether the purpose of collection is specifically to facilitate paid features. From the European Commission: > The GDPR applies to: [...] > 2. a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU. Assuming account names or the content of comments constitute personal data within GDPR, I think YCombinator falls into this group. Edit: I forgot HN collects an optional email address too, which is definitely personal data. Details here: https://www.ycombinator.com/legal/#:~:text=Hacker%20News%20Information%3A https://www.ycombinator.com/legal/#:~:text=Hacker%20News%20I...
  - wrs 4y ago
    The GDPR applies to the data of people residing in the EU. The location and profitability of the organization collecting the data isn’t a factor. (Though it may introduce questions of enforcement.)

ldjb 4y ago

Although many large websites and services allow you to request erasure of your data in an automated way, this is not required by GDPR. GDPR allows individuals to request erasure verbally or in writing, and the data controller than has one month to respond.

pifm_guy 4y ago

There is no requirement to automate GDPR requests. However all organisations must be able to handle GDPR requests via any communication channel. Eg. They need to treat a data deletion request sent via twitter DM as a valid request if they have an official Twitter presence. It is insufficient to require the customer fill out a special web form.

misnome 4y ago
Isn’t it all organisations _that do business_ in the EU? Since this is a free forum with no paid features, I wonder if it would be excluded?
- chriswait 4y ago
  IANAL but I don't think it matters whether the purpose of collection is specifically to facilitate paid features. From the European Commission: > The GDPR applies to: [...] > 2. a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU. Assuming account names or the content of comments constitute personal data within GDPR, I think YCombinator falls into this group. Edit: I forgot HN collects an optional email address too, which is definitely personal data. Details here: https://www.ycombinator.com/legal/#:~:text=Hacker%20News%20Information%3A https://www.ycombinator.com/legal/#:~:text=Hacker%20News%20I...
- wrs 4y ago
  The GDPR applies to the data of people residing in the EU. The location and profitability of the organization collecting the data isn’t a factor. (Though it may introduce questions of enforcement.)