3 ms·

This will be interesting if reddit conducts business (sells ads) in the EU. Hard to see how having such old backups of user content isn't in violation of the GD

by e12e 3y ago

This will be interesting if reddit conducts business (sells ads) in the EU. Hard to see how having such old backups of user content isn't in violation of the GDPR.

OldManRyan 3y ago
IANAL but having dealt with GDPR lawyers in a past career, GDPR allows you to anonymize user data as in, if there is no link between the user and the data, that satisfies a right to erasure request. That is not what is happening here but it is not as if reddit has no way to keep deleted comments and still be GDPR compliant.
- e12e 3y ago
  > if there is no link between the user and the data, that satisfies a right to erasure request. That is not what is happening here Clearly not, as the data and links to user profile has been restored. > but it is not as if reddit has no way to keep deleted comments and still be GDPR compliant. They would have to prove that the data is irreversibly anonymized - which is tricky. Say they keep threads by supplanting an opaque (guuid) user id - and a single message in a single thread mentions a users full name, phone number or email in a reply? Now all of that users messages are associated with a person....
  - OldManRyan 3y ago
    Yes, as I said, that is not what is happening in this instance.
paulmd 3y ago
How do you work GDPR in the context of a site like Wikipedia where the data is licensed CC and iterated on repeatedly by other users in the future? Do you have to flatly delete every sentence (or word) they’ve worked on? Does publishing the dataset as CC sidestep GDPR? Because Reddit has published their dataset via fh-bigquery:Reddit in the past etc. Using GDPR adversarially like this is interesting and I’m not sure where it stops. Technically all IP is originated by a human at some point and then sublicensed to an employer etc. Can you just ragequit and demand your workplace GDPR everything? How is the consideration of cash employment fundamentally different from the consideration of using the social network? Not saying it should or shouldn’t be upheld but under maximalist interpretations GDPR is incompatible with IP sublicensing in general, if the originator always has the option to take back their content how do you ever reach an enforceable license?
- DropInIn 3y ago
  They don't hold exclusive copyright to the work, only a portion of it, usually without copyright at all due to the volume of the work they produced. Typically, a sentence fragment cannot be protected by copyright. The average edit is little more than that.
- e12e 3y ago
  Licensing doesn't really enter into it. Being "a public good"/general publication does (a public figure can't automatically refuse to have a page on wp). That said things like the talk pages might fall under the GDPR - though one could argue that talk pages and edit history has a public value and so overrides the GDPR. As for logging IPs, that is something no one is generally allowed to do indefinitely - you need an overriding reason - like an audit trail for security and spam/abuse prevention - but that will generally only allow for 6 months at a maximum.
  - paulmd 3y ago
    Sure, but this is ignoring the pointed question I was posing here: everyone on Reddit knows they're contributing to a social body of knowledge of the same type (but a somewhat different form) as wikipedia. This isn't facebook storing your family vacation status updates and personal photos, this isn't a bigbox store maintaining an account so you can place orders... the overwhelming majority of content on reddit has always been intended to be a "public good"/general publication, for other people to interact with and respond directly to. Even if a minority of private content is in sheltered places (as it also is on wikipedia) it doesn't change that nature - you comment, other people reply and agree/disagree. If I demand that all my posts reviewing and discussing vacuum cleaners and sharing DIY home remodeling tips be removed, then that diminishes the public good, just as with wikipedia, and really can't even be entirely done (what about fragments of your comments that are quoted in other comments?). GDPR being used to protect personal information is a bit different than GDPR being used as a hammer to retroactively undo the licensing agreements you make with these websites even if GDPR regards that content as being personal information. And those licensing agreements are not dissimilar in kind to many other licensing agreements. Sure, you retain the copyright, but you also granted Reddit an unlimited irrevocable perpetual license, so does that really matter? Can GDPR be used to undo these perpetual licenses? At the end of the day someone always created it, machines cannot be copyright originators, can they always just invoke GDPR and break any license contracts they wish? Again, I'm generally pro-GDPR but at the maximalist interpretation of "I can use GDPR to revoke the license to any content I've ever created from any licensee if it was ever input into a computer" is a bit of a cliff, and in many cases there is not a clear brightline for sites like Reddit (and HN). Are youtube comments a "public good"? They're intended for other people to interact and reply to, for sure. BTW if you send a GDPR request to HN you're going to get the same explanation from dang, HN simply do not allow you to "shreddit" content by blocking edits after a certain point, and does not honor GDPR takedowns. They'll remove your username and specific PII from the content but they regard the actual interaction as being a public good. Other people considered it and replied to it and it's unfair to the other users to allow that content to be yoinked from the public sphere after it's been made part of the communal discourse. And they are a for-profit company too. Same thing as Reddit. If Reddit does the same, and strips your username off the posts, and responds to requests to takedown any PII that's leaked into other comment (username mentions etc) doesn't that satisfy GDPR's requirements to remove PII? Do they have to take down the public-good portion of the content, even if it's non-PII, simply because you generated it? And if so, how can durable IP licenses ever exist under that model if GDPR revocations completely vacate all licenses no matter how irrevocable you word them to be? And again, to make it worse, Reddit has already published the comment dataset under CC via the API, and it's archived by fh-bigquery:reddit and Pushift in forms that can't really be taken down. It's already in torrents around the net, what do you want them to do about it? And does mere openness change any of the licensing/public-good aspects of this? How can you draw a line here without also clobbering wikipedia? https://academictorrents.com/details/7c0645c94321311bb05bd879ddee4d0eba08aaee https://academictorrents.com/details/7c0645c94321311bb05bd87...
rtsil 3y ago
GDPR only covers personally identifiable data, which most of these messages are not. And even if they contain personally identifiable data, the user would need to request the deletion of these ¨PI data from reddit. I am not sure simply deleting your messages yourself counts as requesting the deletion of personal data under GDP.
- lonjil 3y ago
  > GDPR only covers personally identifiable data the concept of 'personal data' under GDPR is quite broad. the mere presence of a username relates those messages to a possibly identifiable person. and asking for something to be deleted is asking for it to be deleted.

by e12e 3y ago

This will be interesting if reddit conducts business (sells ads) in the EU. Hard to see how having such old backups of user content isn't in violation of the GDPR.

OldManRyan 3y ago

IANAL but having dealt with GDPR lawyers in a past career, GDPR allows you to anonymize user data as in, if there is no link between the user and the data, that satisfies a right to erasure request. That is not what is happening here but it is not as if reddit has no way to keep deleted comments and still be GDPR compliant.

e12e 3y ago
> if there is no link between the user and the data, that satisfies a right to erasure request. That is not what is happening here Clearly not, as the data and links to user profile has been restored. > but it is not as if reddit has no way to keep deleted comments and still be GDPR compliant. They would have to prove that the data is irreversibly anonymized - which is tricky. Say they keep threads by supplanting an opaque (guuid) user id - and a single message in a single thread mentions a users full name, phone number or email in a reply? Now all of that users messages are associated with a person....
- OldManRyan 3y ago
  Yes, as I said, that is not what is happening in this instance.

paulmd 3y ago

How do you work GDPR in the context of a site like Wikipedia where the data is licensed CC and iterated on repeatedly by other users in the future? Do you have to flatly delete every sentence (or word) they’ve worked on? Does publishing the dataset as CC sidestep GDPR? Because Reddit has published their dataset via fh-bigquery:Reddit in the past etc. Using GDPR adversarially like this is interesting and I’m not sure where it stops. Technically all IP is originated by a human at some point and then sublicensed to an employer etc. Can you just ragequit and demand your workplace GDPR everything? How is the consideration of cash employment fundamentally different from the consideration of using the social network? Not saying it should or shouldn’t be upheld but under maximalist interpretations GDPR is incompatible with IP sublicensing in general, if the originator always has the option to take back their content how do you ever reach an enforceable license?

DropInIn 3y ago
They don't hold exclusive copyright to the work, only a portion of it, usually without copyright at all due to the volume of the work they produced. Typically, a sentence fragment cannot be protected by copyright. The average edit is little more than that.
e12e 3y ago
Licensing doesn't really enter into it. Being "a public good"/general publication does (a public figure can't automatically refuse to have a page on wp). That said things like the talk pages might fall under the GDPR - though one could argue that talk pages and edit history has a public value and so overrides the GDPR. As for logging IPs, that is something no one is generally allowed to do indefinitely - you need an overriding reason - like an audit trail for security and spam/abuse prevention - but that will generally only allow for 6 months at a maximum.
- paulmd 3y ago
  Sure, but this is ignoring the pointed question I was posing here: everyone on Reddit knows they're contributing to a social body of knowledge of the same type (but a somewhat different form) as wikipedia. This isn't facebook storing your family vacation status updates and personal photos, this isn't a bigbox store maintaining an account so you can place orders... the overwhelming majority of content on reddit has always been intended to be a "public good"/general publication, for other people to interact with and respond directly to. Even if a minority of private content is in sheltered places (as it also is on wikipedia) it doesn't change that nature - you comment, other people reply and agree/disagree. If I demand that all my posts reviewing and discussing vacuum cleaners and sharing DIY home remodeling tips be removed, then that diminishes the public good, just as with wikipedia, and really can't even be entirely done (what about fragments of your comments that are quoted in other comments?). GDPR being used to protect personal information is a bit different than GDPR being used as a hammer to retroactively undo the licensing agreements you make with these websites even if GDPR regards that content as being personal information. And those licensing agreements are not dissimilar in kind to many other licensing agreements. Sure, you retain the copyright, but you also granted Reddit an unlimited irrevocable perpetual license, so does that really matter? Can GDPR be used to undo these perpetual licenses? At the end of the day someone always created it, machines cannot be copyright originators, can they always just invoke GDPR and break any license contracts they wish? Again, I'm generally pro-GDPR but at the maximalist interpretation of "I can use GDPR to revoke the license to any content I've ever created from any licensee if it was ever input into a computer" is a bit of a cliff, and in many cases there is not a clear brightline for sites like Reddit (and HN). Are youtube comments a "public good"? They're intended for other people to interact and reply to, for sure. BTW if you send a GDPR request to HN you're going to get the same explanation from dang, HN simply do not allow you to "shreddit" content by blocking edits after a certain point, and does not honor GDPR takedowns. They'll remove your username and specific PII from the content but they regard the actual interaction as being a public good. Other people considered it and replied to it and it's unfair to the other users to allow that content to be yoinked from the public sphere after it's been made part of the communal discourse. And they are a for-profit company too. Same thing as Reddit. If Reddit does the same, and strips your username off the posts, and responds to requests to takedown any PII that's leaked into other comment (username mentions etc) doesn't that satisfy GDPR's requirements to remove PII? Do they have to take down the public-good portion of the content, even if it's non-PII, simply because you generated it? And if so, how can durable IP licenses ever exist under that model if GDPR revocations completely vacate all licenses no matter how irrevocable you word them to be? And again, to make it worse, Reddit has already published the comment dataset under CC via the API, and it's archived by fh-bigquery:reddit and Pushift in forms that can't really be taken down. It's already in torrents around the net, what do you want them to do about it? And does mere openness change any of the licensing/public-good aspects of this? How can you draw a line here without also clobbering wikipedia? https://academictorrents.com/details/7c0645c94321311bb05bd879ddee4d0eba08aaee https://academictorrents.com/details/7c0645c94321311bb05bd87...

rtsil 3y ago

GDPR only covers personally identifiable data, which most of these messages are not. And even if they contain personally identifiable data, the user would need to request the deletion of these ¨PI data from reddit. I am not sure simply deleting your messages yourself counts as requesting the deletion of personal data under GDP.

lonjil 3y ago
> GDPR only covers personally identifiable data the concept of 'personal data' under GDPR is quite broad. the mere presence of a username relates those messages to a possibly identifiable person. and asking for something to be deleted is asking for it to be deleted.