4 ms·

Using a different identifier isn't sufficient to satisfy a right to be forgotten request. The user's identity could still be inferred from comments, for instanc

Using a different identifier isn't sufficient to satisfy a right to be forgotten request. The user's identity could still be inferred from comments, for instance.

godelski 3y ago
So does that mean that if we request Dang will nuke our accounts (honest question, because it's something I've been thinking about. Maybe or maybe not write a Tell HN)
- andrewmcwatters 3y ago
  He will not, I have asked. Instead, he does what throwboatyface has mentioned. It's bad form.
- I_am_tiberius 3y ago
  He does not, that's the point. I think YC is not on the legal side regarding this topic.
  - godelski 3y ago
    Maybe it is time to write that manifesto. I love the community but the environment has changed underneath us and faster that I, even someone in ML, expected.
  - tzs 3y ago
    Which law(s) do you think they are not on the legal side of? The most common law people cite for deletion rights is GDPR but I'm not sure GDPR applies. GDPR's territorial scope is defined in Article 3. For controllers or processors not "in the Union", which I think is the case for YC, GDPR applies if the processing activities are related to: "(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union." People in the Union can make HN accounts and post, but that doesn't mean that YC is offering goods or services to data subjects in the Union. Recital 23 of GDPR elaborates on offering goods or services (edited to split into two paragraphs to make it easier to read): > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. > Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. I think YC could make a decent case that they do not envisage offering such services to people in the Union.
    - lmm 3y ago
      > > Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. > I think YC could make a decent case that they do not envisage offering such services to people in the Union. I very much doubt it. YC has an explicit list of European-based companies in their portfolio; they have posted job ads on HN for positions that were based exclusively in EU countries, and continue to do so as far as I can tell. PG is on the record talking about using HN from the UK (no longer part of the EU, but it was at the time).
temp112123 3y ago
As an aside- If you ask nicely they'll edit/remove the PII from the comments.

Using a different identifier isn't sufficient to satisfy a right to be forgotten request. The user's identity could still be inferred from comments, for instance.

godelski 3y ago

So does that mean that if we request Dang will nuke our accounts (honest question, because it's something I've been thinking about. Maybe or maybe not write a Tell HN)

andrewmcwatters 3y ago
He will not, I have asked. Instead, he does what throwboatyface has mentioned. It's bad form.
I_am_tiberius 3y ago
He does not, that's the point. I think YC is not on the legal side regarding this topic.
- godelski 3y ago
  Maybe it is time to write that manifesto. I love the community but the environment has changed underneath us and faster that I, even someone in ML, expected.
- tzs 3y ago
  Which law(s) do you think they are not on the legal side of? The most common law people cite for deletion rights is GDPR but I'm not sure GDPR applies. GDPR's territorial scope is defined in Article 3. For controllers or processors not "in the Union", which I think is the case for YC, GDPR applies if the processing activities are related to: "(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union." People in the Union can make HN accounts and post, but that doesn't mean that YC is offering goods or services to data subjects in the Union. Recital 23 of GDPR elaborates on offering goods or services (edited to split into two paragraphs to make it easier to read): > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. > Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. I think YC could make a decent case that they do not envisage offering such services to people in the Union.
  - lmm 3y ago
    > > Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union. > I think YC could make a decent case that they do not envisage offering such services to people in the Union. I very much doubt it. YC has an explicit list of European-based companies in their portfolio; they have posted job ads on HN for positions that were based exclusively in EU countries, and continue to do so as far as I can tell. PG is on the record talking about using HN from the UK (no longer part of the EU, but it was at the time).

temp112123 3y ago

As an aside- If you ask nicely they'll edit/remove the PII from the comments.