4 ms·

Wow wow, Isn't this the violation of the Europen GDPR privacy laws. If you deletd it then they should actually be deleted, otherwise you are violating the laws.

by jlpcsl 3y ago

tanepiper 3y ago
Yes and the irony is I was in Oslo today, showing to people within the EU our PoC demo for IKEA.com - on how we can provide recommendations with no third party data - and with the idea of consumers controlling exactly what is used to provide it - including the right to delete it all. This is the way we're going - totally the opposite way.
- oh_sigh 3y ago
  Is your poc or a further description of it up online anywhere?
  - tanepiper 3y ago
    Not yet - we built it in 3 days, as a Chrome extension (so it works on IKEA.com) on top of our Knowledge Graph as sessionless - it was part of the OntoCommons innovation lab hackathon (https://www.linkedin.com/posts/michelamagas_ontology-commons-addressing-challenges-of-activity-7075148421543698432-NFlB https://www.linkedin.com/posts/michelamagas_ontology-commons...)
- libraryatnight 3y ago
  I want to go with you. The US is so awful for privacy, not just at an administrative level, but we have too many citizens that do not care ('nothing to hide') and believe in an internet that can only be funded by giving up privacy. (Just look to HN for many "well, how else do you pay for it?!" arms tossed up comments) For a people that seem to think we're synonymous with 'freedom,' the paths we choose sure seem to indicate a fucked up vision of what 'freedom' looks like going forward. Too many attitudes feel defeated and resigned to abusive things today.
avgDev 3y ago
I am planning on using my EU citizenship to have reddit wipe my history completely.
- martin8412 3y ago
  I believe you can absolutely revoke your consent to Reddit processing your data and demand that they remove any and all PII from their records. That will force them to go through your entire comment history and identify any such information.
brucethemoose2 3y ago
There must be some legal justification for reddit doing this. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ Maybe Reddit users don't qualify for "Right to Erasure" because Reddit is still going, their data is being used, they technically didn't revoke "consent" and so on?
- jpgvm 3y ago
  That is not how that works. The right to keep data beyond when a user requests it's deletion is contingent on it being needed for ongoing business requirements like tax and other audit requirements, not for content. It's not possible under GDPR to automatically license user submitted content via a ToS or something. If you want to keep content beyond when a user clicks a delete button you would need a contract that provides reasonable compensation for licensing that content.
  - brucethemoose2 3y ago
    Does the button to delete a Reddit account+posts absolutely qualify as revoking consent? (I am not trying to be combative, I am just unfamiliar with GDPR)
    - jpgvm 3y ago
      The GDPR itself is purposefully vague but is generally interpreted favouring the user so I would err on the side of it being revocation. We have always treated this way in SaaS startups I have worked at and I don't imagine you would get a more charitable reading of that as a social network an in EU court. That said. IANAL.
- brucethemoose2 3y ago
  For instance, Article 9 in relation to Article 17 seems pretty solid: > the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing > Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. But perhaps deleting an account + posts does not qualify as revoking consent? I dunno anything about GDPR, but Reddit would have to be confident about every condition in Article 17. It makes me think these undeletions are a considered decision, not a knee jerk response.
krunck 3y ago
Information is money and power. No one deletes that.
AlanYx 3y ago
Add that to the minefield of GDPR issues Reddit has to confront. They've provided the whole Reddit comment corpus to researchers, several located in Europe, though the PushShift dataset. There are no real privacy controls on that dataset (anyone can query it) and apparently no way to process removal requests.
notatoad 3y ago
Is it? I understand that the GDPR allows you to request deletion of your private data, but content you’ve published isn’t quite the same. At the very least, Reddit’s TOS claim a perpetual irrevocable license to that content Does the GDPR have a separate provision for requesting the deletion of published content, or are people just assuming it falls under the private data rules?
- DropInIn 3y ago
  Copyright doesn't work like that and comments are protected by copyright Reddit is up against the laws that even bigger assholes had made to fuck over people who use copyright material without explicit permission...
systemtest 3y ago
I wonder if there is a legal difference between submitting an official GDPR request for deletion and simply hitting the delete button on the platform itself.
rtsil 3y ago
Most of it isn't. GDPR covers only personally identifiable data, not all user-related data. Unless you doxxed yourself in your comment, there's no personally identifiable data in those.
srmarm 3y ago
Most reddit posts wouldn't be considered PII and I'm not sure the 'delete' function on a reddit post constitutes a GDPR removal request (it's not clear how this user purged their data). The reddit FAQ around deleting your account[0] suggests that they'll just 'dissociate' your posts from your account (so the user says [deleted]) and remove your account data which should be fine for GDPR purposes. This[1] support page says mods/admins can't recover your deleted posts for you but stops a little short of saying that it's impossible for them to do it for themselves. So pretty scummy behaviour but I don't think anything they're doing is illegal (IANAL!). [0] https://support.reddithelp.com/hc/en-us/articles/360043047932-If-I-delete-my-account-what-happens-to-my-username-posts-and-comments- https://support.reddithelp.com/hc/en-us/articles/36004304793... [1] https://support.reddithelp.com/hc/en-us/articles/360043483451-If-I-delete-a-post-or-comment-can-it-be-restored- https://support.reddithelp.com/hc/en-us/articles/36004348345...

Wow wow, Isn't this the violation of the Europen GDPR privacy laws. If you deletd it then they should actually be deleted, otherwise you are violating the laws.

by jlpcsl 3y ago

Wow wow, Isn't this the violation of the Europen GDPR privacy laws. If you deletd it then they should actually be deleted, otherwise you are violating the laws.

tanepiper 3y ago

Yes and the irony is I was in Oslo today, showing to people within the EU our PoC demo for IKEA.com - on how we can provide recommendations with no third party data - and with the idea of consumers controlling exactly what is used to provide it - including the right to delete it all. This is the way we're going - totally the opposite way.

oh_sigh 3y ago
Is your poc or a further description of it up online anywhere?
- tanepiper 3y ago
  Not yet - we built it in 3 days, as a Chrome extension (so it works on IKEA.com) on top of our Knowledge Graph as sessionless - it was part of the OntoCommons innovation lab hackathon (https://www.linkedin.com/posts/michelamagas_ontology-commons-addressing-challenges-of-activity-7075148421543698432-NFlB https://www.linkedin.com/posts/michelamagas_ontology-commons...)
libraryatnight 3y ago
I want to go with you. The US is so awful for privacy, not just at an administrative level, but we have too many citizens that do not care ('nothing to hide') and believe in an internet that can only be funded by giving up privacy. (Just look to HN for many "well, how else do you pay for it?!" arms tossed up comments) For a people that seem to think we're synonymous with 'freedom,' the paths we choose sure seem to indicate a fucked up vision of what 'freedom' looks like going forward. Too many attitudes feel defeated and resigned to abusive things today.

avgDev 3y ago

I am planning on using my EU citizenship to have reddit wipe my history completely.

martin8412 3y ago
I believe you can absolutely revoke your consent to Reddit processing your data and demand that they remove any and all PII from their records. That will force them to go through your entire comment history and identify any such information.

brucethemoose2 3y ago

There must be some legal justification for reddit doing this. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ Maybe Reddit users don't qualify for "Right to Erasure" because Reddit is still going, their data is being used, they technically didn't revoke "consent" and so on?

jpgvm 3y ago
That is not how that works. The right to keep data beyond when a user requests it's deletion is contingent on it being needed for ongoing business requirements like tax and other audit requirements, not for content. It's not possible under GDPR to automatically license user submitted content via a ToS or something. If you want to keep content beyond when a user clicks a delete button you would need a contract that provides reasonable compensation for licensing that content.
- brucethemoose2 3y ago
  Does the button to delete a Reddit account+posts absolutely qualify as revoking consent? (I am not trying to be combative, I am just unfamiliar with GDPR)
  - jpgvm 3y ago
    The GDPR itself is purposefully vague but is generally interpreted favouring the user so I would err on the side of it being revocation. We have always treated this way in SaaS startups I have worked at and I don't imagine you would get a more charitable reading of that as a social network an in EU court. That said. IANAL.
brucethemoose2 3y ago
For instance, Article 9 in relation to Article 17 seems pretty solid: > the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing > Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. But perhaps deleting an account + posts does not qualify as revoking consent? I dunno anything about GDPR, but Reddit would have to be confident about every condition in Article 17. It makes me think these undeletions are a considered decision, not a knee jerk response.

krunck 3y ago

Information is money and power. No one deletes that.

AlanYx 3y ago

Add that to the minefield of GDPR issues Reddit has to confront. They've provided the whole Reddit comment corpus to researchers, several located in Europe, though the PushShift dataset. There are no real privacy controls on that dataset (anyone can query it) and apparently no way to process removal requests.

notatoad 3y ago

Is it? I understand that the GDPR allows you to request deletion of your private data, but content you’ve published isn’t quite the same. At the very least, Reddit’s TOS claim a perpetual irrevocable license to that content Does the GDPR have a separate provision for requesting the deletion of published content, or are people just assuming it falls under the private data rules?

DropInIn 3y ago
Copyright doesn't work like that and comments are protected by copyright Reddit is up against the laws that even bigger assholes had made to fuck over people who use copyright material without explicit permission...

systemtest 3y ago

I wonder if there is a legal difference between submitting an official GDPR request for deletion and simply hitting the delete button on the platform itself.

rtsil 3y ago

Most of it isn't. GDPR covers only personally identifiable data, not all user-related data. Unless you doxxed yourself in your comment, there's no personally identifiable data in those.

srmarm 3y ago

Most reddit posts wouldn't be considered PII and I'm not sure the 'delete' function on a reddit post constitutes a GDPR removal request (it's not clear how this user purged their data). The reddit FAQ around deleting your account[0] suggests that they'll just 'dissociate' your posts from your account (so the user says [deleted]) and remove your account data which should be fine for GDPR purposes. This[1] support page says mods/admins can't recover your deleted posts for you but stops a little short of saying that it's impossible for them to do it for themselves. So pretty scummy behaviour but I don't think anything they're doing is illegal (IANAL!). [0] https://support.reddithelp.com/hc/en-us/articles/360043047932-If-I-delete-my-account-what-happens-to-my-username-posts-and-comments- https://support.reddithelp.com/hc/en-us/articles/36004304793... [1] https://support.reddithelp.com/hc/en-us/articles/360043483451-If-I-delete-a-post-or-comment-can-it-be-restored- https://support.reddithelp.com/hc/en-us/articles/36004348345...