4 ms·

GDPR requires deleting personal data upon request unless required to be held by law.

fabian2k 3y ago
Your Reddit posts are not personal data. Okay, you can probably get specific ones removed that way where you explicitly include personal data. But this doesn't mean that you have a right to delete all content you write anywhere.
- blueblob 3y ago
  Your Reddit posts absolutely can have personally identifying information and therefore are subject to GDPR.
  - fabian2k 3y ago
    But we're talking about mass deletion of all your content here. If you specifically mention your real name or address or something like that in a post, it's a different situation.
    - chongli 3y ago
      I think the fact that all of your posts are tagged with your userid means they can all be traced back to you, making them all personal information. It's not hard to see how, for example, some employer might get ahold of your Reddit userid and crawl through your post history, looking for any opinion of yours that they don't like.
    - Aaargh20318 3y ago
      There is almost 14 years of posts and comments linked to my account. While I'm always careful to not reveal any personal information online, if you mine through 14 years of reddit content I posted I guarantee you that there would be enough little nuggets of information there to figure out my actual identity. You are sharing a lot more than you think you do. Here is a good example of how much can me determined from a single short video: https://www.linkedin.com/posts/gabrielfriedlander_youve-got-to-show-this-to-your-kids-its-ugcPost-7074109770009325568-Y_Nl https://www.linkedin.com/posts/gabrielfriedlander_youve-got-...
- bombcar 3y ago
  It's a weird interaction with Section 230 if Reddit can say "these posts are not ours, they are the posters" and yet the poster cannot edit/delete them. Of course, HN itself kills your edit window after a certain time limit, so there is some legal way of doing it, I assume.
  - tazjin 3y ago
    HN also has a prominent FAQ entry about this where they say they will help you with deletion requests for personal information if you email them.
  - brookst 3y ago
    Section 230 does not talk about ownership. A freight company is generally not liable for contraband shipped without its knowledge. That does not mean that all shipments become the property of the freight company. Same thing.
    - bombcar 3y ago
      A freight company that took your freight, refused to give it back, and acted like it was now theirs would appear to own it. If Reddit says "your content is yours but you cannot delete it" they're in a bit of a cake-and-eat-it-too scenario. I'm entirely sure it's legal (as other forums/HN/etc do it too) but I'm not sure it's right.
      - brookst 3y ago
        > If Reddit says "your content is yours but you cannot delete it" they're in a bit of a cake-and-eat-it-too scenario. Yes, but the user is also in a cake-and-eat-it-to scenario: they get to own the content and have it distributed for free. Both sides of this come from the perpetual non-exclusive license that posting to Reddit or Twitter or anywhere confers. "Ownership" is too reductive a concept for IP, which is why the section 230 thing is a non sequitur.
- rurban 3y ago
  It is. See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... Only if your personal posts are important for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing.
  - Pyramus 3y ago
    No, you are confusing, say, a post, with its content. The content of a post does (in general) not relate to an identifiable person.
    - bee_rider 3y ago
      This may legally be the case, but it is worth noting that there are various tools out there to try and find posts written by the same person under different names. They use word frequencies, I think. So, this seems like a case of the law not 100% matching reality. Sometimes the EU adjusts their laws to keep up with reality, I think? (The idea of trying to make sensible laws is pretty foreign to me, but then I’m an American.
- jacobp100 3y ago
  We have a ‘right to be forgotten’ law
- stev-0 3y ago
  If your user account can be related to your person it’s most definitely personal data by European standards.
- janAkali 3y ago
  [0]European Commission defines personal data as: >Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. Thus, anything you wrote on any site, if it is not anonymised and still linked or could be traced to your account is a personal data. And even when it is anonymised: >Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR. [0] - https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...

Your Reddit posts are not personal data. Okay, you can probably get specific ones removed that way where you explicitly include personal data. But this doesn't mean that you have a right to delete all content you write anywhere.

blueblob 3y ago
Your Reddit posts absolutely can have personally identifying information and therefore are subject to GDPR.
- fabian2k 3y ago
  But we're talking about mass deletion of all your content here. If you specifically mention your real name or address or something like that in a post, it's a different situation.
  - chongli 3y ago
    I think the fact that all of your posts are tagged with your userid means they can all be traced back to you, making them all personal information. It's not hard to see how, for example, some employer might get ahold of your Reddit userid and crawl through your post history, looking for any opinion of yours that they don't like.
  - Aaargh20318 3y ago
    There is almost 14 years of posts and comments linked to my account. While I'm always careful to not reveal any personal information online, if you mine through 14 years of reddit content I posted I guarantee you that there would be enough little nuggets of information there to figure out my actual identity. You are sharing a lot more than you think you do. Here is a good example of how much can me determined from a single short video: https://www.linkedin.com/posts/gabrielfriedlander_youve-got-to-show-this-to-your-kids-its-ugcPost-7074109770009325568-Y_Nl https://www.linkedin.com/posts/gabrielfriedlander_youve-got-...
bombcar 3y ago
It's a weird interaction with Section 230 if Reddit can say "these posts are not ours, they are the posters" and yet the poster cannot edit/delete them. Of course, HN itself kills your edit window after a certain time limit, so there is some legal way of doing it, I assume.
- tazjin 3y ago
  HN also has a prominent FAQ entry about this where they say they will help you with deletion requests for personal information if you email them.
- brookst 3y ago
  Section 230 does not talk about ownership. A freight company is generally not liable for contraband shipped without its knowledge. That does not mean that all shipments become the property of the freight company. Same thing.
  - bombcar 3y ago
    A freight company that took your freight, refused to give it back, and acted like it was now theirs would appear to own it. If Reddit says "your content is yours but you cannot delete it" they're in a bit of a cake-and-eat-it-too scenario. I'm entirely sure it's legal (as other forums/HN/etc do it too) but I'm not sure it's right.
    - brookst 3y ago
      > If Reddit says "your content is yours but you cannot delete it" they're in a bit of a cake-and-eat-it-too scenario. Yes, but the user is also in a cake-and-eat-it-to scenario: they get to own the content and have it distributed for free. Both sides of this come from the perpetual non-exclusive license that posting to Reddit or Twitter or anywhere confers. "Ownership" is too reductive a concept for IP, which is why the section 230 thing is a non sequitur.
rurban 3y ago
It is. See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... Only if your personal posts are important for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing.
- Pyramus 3y ago
  No, you are confusing, say, a post, with its content. The content of a post does (in general) not relate to an identifiable person.
  - bee_rider 3y ago
    This may legally be the case, but it is worth noting that there are various tools out there to try and find posts written by the same person under different names. They use word frequencies, I think. So, this seems like a case of the law not 100% matching reality. Sometimes the EU adjusts their laws to keep up with reality, I think? (The idea of trying to make sensible laws is pretty foreign to me, but then I’m an American.
jacobp100 3y ago
We have a ‘right to be forgotten’ law
stev-0 3y ago
If your user account can be related to your person it’s most definitely personal data by European standards.
janAkali 3y ago
[0]European Commission defines personal data as: >Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. Thus, anything you wrote on any site, if it is not anonymised and still linked or could be traced to your account is a personal data. And even when it is anonymised: >Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR. [0] - https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...