6 ms·
> You don't have the right to force the company to delete content [relating to you] In the EU, you definitely do.
by Hendrikto 3y ago
> You don't have the right to force the company to delete content [relating to you]
In the EU, you definitely do.
- Pyramus 3y agoNo, check GDPR Article 4 (1): personal data means any information relating to an identified or identifiable person. The content of a post is not personal data (in general) but the things like user name etc are. The content is not relating to an identifiable person (in general) while the user name is. Shakespeare's poems are not personal data.
- theRBII 3y agoDepends on the content - not many people out there are directly doxxing themselves but indirectly? Maybe. From my post history on Reddit, you'd know where I live, my age, gender, job, relationship status and a good amount about places I've been and my interests. There are already websites that collate that info from a profile to give a summary of the user. Under GDPR, that quite possibly adds up to personal data relating to an identifiable person.
- vidanay 3y agoAnd when this is combined with Facebook/Google/Apple/Microsoft shadow profiles, it's an almost certain guarantee that information is linked with your name, DOB, credit info, and tax ID number.
- Pyramus 3y agoNot disagreeing with you or parent in general, that a post (or as you point out a history of posts) can be personal data. What I'm saying is, in general it isn't. If you sign up to platform XYZ and make a post, in general, the content of the post is not personal data. It certainly can be. But by default it isn't. That's a misconception I want to dispel.
- Algent 3y agoYep I agree, if you posted on a specific subreddit this is already personal information about yourself. There is no way they are not violating GDPR if they deny a request to delete (but I guess they can block direct deletion in bad faith and tell you to submit a direct request).
- Pyramus 3y agoI'm not saying the content of a post can not be personal data. I'm saying it is not by default. The words "Hello world" posted on any subreddit is not personal data. In this case the company could simply delete the information relating to you such as user name, IP etc. The content you post is not, in general, personal data. It certainly can be.
- Tao3300 3y agoThat's kind of funny, because "Hello World" gives a strong indication of your profession and interests. Not enough on its own to be PII, but a useful data point.
- koheripbal 3y agoThe moment they post it publicly, it is no longer considered personal private content
- mynameisvlad 3y agoThat’s not the definition of personal data. I can post my name publicly, but it’s still considered personal data. It doesn’t magically become a free for all just because it’s out there.
- smarx007 3y agoNo, personal data in GDPR is much wider than American PII definition.
- veave 3y agoMaybe so, but stuff you post on public forums is not PII, neither by the American nor the European definition.
- SkyPuncher 3y agoSomething similar happens with HIPAA that people don’t understand. Personal Health Information is only applicable in a specific setting (a covered entity). You telling your boss/friend/form about your health information does not make it PHI. You willingly disclosed that information.m, it loses its protected status.
- deleted 3y ago[deleted]
- dminuoso 3y agoGDPR has no such exclusion criteria. The definition is astonishingly simple: ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’). Note the weight of the word “any” here.
- robertlagrant 3y agoWell, within reason. You need a policy that allows this to happen, but, for example, it can't just reach into 3 months' worth of PIT database backups. But you can say "we will delete your user now, and your data will roll out of our backups after 3 months." That's reasonable while still delivering the main objective: companies can't keep your (identifiable) data forever.
- derefr 3y agoNo, you're thinking of the right to force the company to delete content that you yourself, and your interactions with their system (or the system's observations of you) were causal to generating within their systems. For a clear example of the difference: I don't have the right under GDPR to tell Apple to reach into everyone else's iCloud address books to delete my phone number out of them. Neither I nor Apple put my phone number into other people's address books; those other people manually entered that info into their address books themselves. Which makes that their data, that they created — which just happens to reference me (and which is held in trust by a third party.) If GDPR worked the way you're imagining, then someone deleting their WhatsApp account would require WhatsApp to tell my phone to delete my locally-saved WhatsApp chat-logs of conversations with that person.
- xp84 3y agoOkay, and what are Reddit comments besides UGC that users directly generated?
- deleted 3y ago[deleted]