6 ms·

Where does the idea come from that not allowing users to delete content is against the law/GPDR? You have the right to ask for deletion of personal information

Where does the idea come from that not allowing users to delete content is against the law/GPDR? You have the right to ask for deletion of personal information they store, and even that has certain limits. You don't have the right to force the company to delete content unless they granted you that right via the licence somehow. Whether this is a good or bad idea for a company to do is a different question. But I don't see a legal issue here like the linked post claims.

Drakim 3y ago
What if that content includes personal data about me? My hopes, dreams, preferences, plans, goals and political opinions?
- LudwigNagasena 3y ago
  That’s an interesting question in principle (even if there are some clear legal directives). You can try to reconstruct a user profile even just from a list of commonly visited subreddits. It can help gauge age, location, personal interests and political convictions. And if you have access to the content of the messages, well, even doxing may be possible.
- codingdave 3y ago
  What if it does? I am not under the impression that those fall under PII/GDPR (IANAL), so if you post that stuff online to a site you do not control, it certainly has the potential to remain there. And that is the heart of one the problems with reddit or any other site that encourages people to post everything under the sun. You are giving up control of what then happens with your content.
  - jwestbury 3y ago
    GDPR protects any data which can be tied to an identifiable person. So, if reddit posts are attached to my username, and my username can ultimately be tied back to me (see: my username is my name), then reddit cannot disallow deletion of these posts. There may be a workaround by no longer identifying them with a specific user, but this would have to be done on the back end, as simply changing who the displayed user is would still leave the data intact.
Hendrikto 3y ago
> You don't have the right to force the company to delete content [relating to you] In the EU, you definitely do.
- Pyramus 3y ago
  No, check GDPR Article 4 (1): personal data means any information relating to an identified or identifiable person. The content of a post is not personal data (in general) but the things like user name etc are. The content is not relating to an identifiable person (in general) while the user name is. Shakespeare's poems are not personal data.
  - theRBII 3y ago
    Depends on the content - not many people out there are directly doxxing themselves but indirectly? Maybe. From my post history on Reddit, you'd know where I live, my age, gender, job, relationship status and a good amount about places I've been and my interests. There are already websites that collate that info from a profile to give a summary of the user. Under GDPR, that quite possibly adds up to personal data relating to an identifiable person.
    - vidanay 3y ago
      And when this is combined with Facebook/Google/Apple/Microsoft shadow profiles, it's an almost certain guarantee that information is linked with your name, DOB, credit info, and tax ID number.
      - Pyramus 3y ago
        Not disagreeing with you or parent in general, that a post (or as you point out a history of posts) can be personal data. What I'm saying is, in general it isn't. If you sign up to platform XYZ and make a post, in general, the content of the post is not personal data. It certainly can be. But by default it isn't. That's a misconception I want to dispel.
    - 3y ago
barrkel 3y ago
GDPR requires deleting personal data upon request unless required to be held by law.
- fabian2k 3y ago
  Your Reddit posts are not personal data. Okay, you can probably get specific ones removed that way where you explicitly include personal data. But this doesn't mean that you have a right to delete all content you write anywhere.
  - blueblob 3y ago
    Your Reddit posts absolutely can have personally identifying information and therefore are subject to GDPR.
    - fabian2k 3y ago
      But we're talking about mass deletion of all your content here. If you specifically mention your real name or address or something like that in a post, it's a different situation.
      - chongli 3y ago
        I think the fact that all of your posts are tagged with your userid means they can all be traced back to you, making them all personal information. It's not hard to see how, for example, some employer might get ahold of your Reddit userid and crawl through your post history, looking for any opinion of yours that they don't like.
      - Aaargh20318 3y ago
        There is almost 14 years of posts and comments linked to my account. While I'm always careful to not reveal any personal information online, if you mine through 14 years of reddit content I posted I guarantee you that there would be enough little nuggets of information there to figure out my actual identity. You are sharing a lot more than you think you do. Here is a good example of how much can me determined from a single short video: https://www.linkedin.com/posts/gabrielfriedlander_youve-got-to-show-this-to-your-kids-its-ugcPost-7074109770009325568-Y_Nl https://www.linkedin.com/posts/gabrielfriedlander_youve-got-...
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
izoow 3y ago
I'm not sure about the specifics of GDPR, but it could be argued that even your style of writing personally identifies you. There are even projects that do just that to find alternate reddit accounts of people [1]. [1] https://github.com/jabraunlin/reddit-user-id https://github.com/jabraunlin/reddit-user-id
anjc 3y ago
If you were to post on another public website "My name is X, and my Reddit username is Y", would your anonymous Reddit posts now be considered personal data? I suppose this would constitute indirect identification of a data subject under GDPR?

Drakim 3y ago

What if that content includes personal data about me? My hopes, dreams, preferences, plans, goals and political opinions?

LudwigNagasena 3y ago
That’s an interesting question in principle (even if there are some clear legal directives). You can try to reconstruct a user profile even just from a list of commonly visited subreddits. It can help gauge age, location, personal interests and political convictions. And if you have access to the content of the messages, well, even doxing may be possible.
codingdave 3y ago
What if it does? I am not under the impression that those fall under PII/GDPR (IANAL), so if you post that stuff online to a site you do not control, it certainly has the potential to remain there. And that is the heart of one the problems with reddit or any other site that encourages people to post everything under the sun. You are giving up control of what then happens with your content.
- jwestbury 3y ago
  GDPR protects any data which can be tied to an identifiable person. So, if reddit posts are attached to my username, and my username can ultimately be tied back to me (see: my username is my name), then reddit cannot disallow deletion of these posts. There may be a workaround by no longer identifying them with a specific user, but this would have to be done on the back end, as simply changing who the displayed user is would still leave the data intact.

Hendrikto 3y ago

> You don't have the right to force the company to delete content [relating to you] In the EU, you definitely do.

Pyramus 3y ago
No, check GDPR Article 4 (1): personal data means any information relating to an identified or identifiable person. The content of a post is not personal data (in general) but the things like user name etc are. The content is not relating to an identifiable person (in general) while the user name is. Shakespeare's poems are not personal data.
- theRBII 3y ago
  Depends on the content - not many people out there are directly doxxing themselves but indirectly? Maybe. From my post history on Reddit, you'd know where I live, my age, gender, job, relationship status and a good amount about places I've been and my interests. There are already websites that collate that info from a profile to give a summary of the user. Under GDPR, that quite possibly adds up to personal data relating to an identifiable person.
  - vidanay 3y ago
    And when this is combined with Facebook/Google/Apple/Microsoft shadow profiles, it's an almost certain guarantee that information is linked with your name, DOB, credit info, and tax ID number.
    - Pyramus 3y ago
      Not disagreeing with you or parent in general, that a post (or as you point out a history of posts) can be personal data. What I'm saying is, in general it isn't. If you sign up to platform XYZ and make a post, in general, the content of the post is not personal data. It certainly can be. But by default it isn't. That's a misconception I want to dispel.
  - 3y ago

barrkel 3y ago

GDPR requires deleting personal data upon request unless required to be held by law.

fabian2k 3y ago
Your Reddit posts are not personal data. Okay, you can probably get specific ones removed that way where you explicitly include personal data. But this doesn't mean that you have a right to delete all content you write anywhere.
- blueblob 3y ago
  Your Reddit posts absolutely can have personally identifying information and therefore are subject to GDPR.
  - fabian2k 3y ago
    But we're talking about mass deletion of all your content here. If you specifically mention your real name or address or something like that in a post, it's a different situation.
    - chongli 3y ago
      I think the fact that all of your posts are tagged with your userid means they can all be traced back to you, making them all personal information. It's not hard to see how, for example, some employer might get ahold of your Reddit userid and crawl through your post history, looking for any opinion of yours that they don't like.
    - Aaargh20318 3y ago
      There is almost 14 years of posts and comments linked to my account. While I'm always careful to not reveal any personal information online, if you mine through 14 years of reddit content I posted I guarantee you that there would be enough little nuggets of information there to figure out my actual identity. You are sharing a lot more than you think you do. Here is a good example of how much can me determined from a single short video: https://www.linkedin.com/posts/gabrielfriedlander_youve-got-to-show-this-to-your-kids-its-ugcPost-7074109770009325568-Y_Nl https://www.linkedin.com/posts/gabrielfriedlander_youve-got-...

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

izoow 3y ago

I'm not sure about the specifics of GDPR, but it could be argued that even your style of writing personally identifies you. There are even projects that do just that to find alternate reddit accounts of people [1]. [1] https://github.com/jabraunlin/reddit-user-id https://github.com/jabraunlin/reddit-user-id

anjc 3y ago

If you were to post on another public website "My name is X, and my Reddit username is Y", would your anonymous Reddit posts now be considered personal data? I suppose this would constitute indirect identification of a data subject under GDPR?