3 ms·

There must be some legal justification for reddit doing this. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ Maybe Reddit users don't qua

There must be some legal justification for reddit doing this. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ Maybe Reddit users don't qualify for "Right to Erasure" because Reddit is still going, their data is being used, they technically didn't revoke "consent" and so on?

jpgvm 3y ago
That is not how that works. The right to keep data beyond when a user requests it's deletion is contingent on it being needed for ongoing business requirements like tax and other audit requirements, not for content. It's not possible under GDPR to automatically license user submitted content via a ToS or something. If you want to keep content beyond when a user clicks a delete button you would need a contract that provides reasonable compensation for licensing that content.
- brucethemoose2 3y ago
  Does the button to delete a Reddit account+posts absolutely qualify as revoking consent? (I am not trying to be combative, I am just unfamiliar with GDPR)
  - jpgvm 3y ago
    The GDPR itself is purposefully vague but is generally interpreted favouring the user so I would err on the side of it being revocation. We have always treated this way in SaaS startups I have worked at and I don't imagine you would get a more charitable reading of that as a social network an in EU court. That said. IANAL.
brucethemoose2 3y ago
For instance, Article 9 in relation to Article 17 seems pretty solid: > the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing > Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. But perhaps deleting an account + posts does not qualify as revoking consent? I dunno anything about GDPR, but Reddit would have to be confident about every condition in Article 17. It makes me think these undeletions are a considered decision, not a knee jerk response.

jpgvm 3y ago

That is not how that works. The right to keep data beyond when a user requests it's deletion is contingent on it being needed for ongoing business requirements like tax and other audit requirements, not for content. It's not possible under GDPR to automatically license user submitted content via a ToS or something. If you want to keep content beyond when a user clicks a delete button you would need a contract that provides reasonable compensation for licensing that content.

brucethemoose2 3y ago
Does the button to delete a Reddit account+posts absolutely qualify as revoking consent? (I am not trying to be combative, I am just unfamiliar with GDPR)
- jpgvm 3y ago
  The GDPR itself is purposefully vague but is generally interpreted favouring the user so I would err on the side of it being revocation. We have always treated this way in SaaS startups I have worked at and I don't imagine you would get a more charitable reading of that as a social network an in EU court. That said. IANAL.

brucethemoose2 3y ago

For instance, Article 9 in relation to Article 17 seems pretty solid: > the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing > Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. But perhaps deleting an account + posts does not qualify as revoking consent? I dunno anything about GDPR, but Reddit would have to be confident about every condition in Article 17. It makes me think these undeletions are a considered decision, not a knee jerk response.