5 ms·
Is Wordpress.org GDPR Compliant?
- Woshiwuja 2y ago[dead]
- doubtfuluser 2y agoThanks for writing this up!!! I just wondered about the following (unrelated) triggered by this: Am I entitled under GDPR to get the internal writeups on my interview performance when I interviewed at a company? Does it matter whether I am in the EU but interview at a US company?
- doubtfuluser 2y agoClaude thinks I am entitled to- but CISNAL (Claude is not a lawyer)
- eadmund 2y agoWhy do people write ‘Claude thinks’ or ‘ChatGPT says’? It’s literally less reliable than ‘some guy down at the bar said’ or ‘my mother’s cousin’s ex-boyfriend’s cat’s previous owner’s dad thinks.’
- Nathanba 2y agoit's part of being honest and citing your possibly unreliable source, you should be very glad about people who do this. The real problem is that he didn't post any actual information in his comment.
- paulryanrogers 2y agoYou both seem to agree that LLM answers are just noise
- CoastalCoder 2y agoMy guess is that it's accepting the anthropomorphisms pushed by the vendors' naming choices: Alexa, Siri, Claude, etc.
- bryanrasmussen 2y agoI'm pretty sure that ChatGPT or Clause is more reliable than a random guy on any particular subject, although less reliable than an expert on the subject.
- intunderflow 2y agoMy past experience is that yes you can DSAR scorecards if you are covered by GDPR, aka you are in the EU.
- bugtodiffer 2y agoAll data means all data, including that yes.
- sureIy 2y agoYes but what is the point? You're asking to get fired or to be moved to the basement.
- qup 2y agoI didn't imagine they got hired.
- mhitza 2y ago> Subjective information such as opinions, judgements or estimates can be personal data. Thus, this includes an assessment of creditworthiness of a person or an estimate of work performance by an employer. https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/ > Does it matter whether I am in the EU but interview at a US company? Yes, in practice. GDPR applies any time that EU/EEA residents' personal data is processes. If the company doesn't operate in the EU/EEA directly it's likely you are going to have a hard time getting this data, and more likely to not be given this data at all. It's up to you as a resident to formalize a complaint through your regional DPA (Data Protection Authority) in those cases.
- Yossarrian22 2y agoDo most companies do such writeups? We don't at mine.
- spacemanspiff01 2y agoI know the last company I worked for had each interviewer interview separately, then had each person write up a few paragraphs of thoughts. Then they were allowed to discuss with each other.
- bryanrasmussen 2y agoWhat benefit would it be if you did?
- rglullis 2y agoAnother case of people thinking that GDPR is a magic word that can make any wish come true. > I replied with a (not so-friendly) email pointing out that I was entitled to a copy of any messages because they contain my personal data. Hum, no? You are entitled to a copy of the data that you provided to the data processor. Your messages, your records, even your IP address for the sessions on your devices. A message that someone mentions you is not your data.
- robin_reala 2y agoI don’t think that’s correct? Section 39 doesn’t say anything about data you’ve provided, but data that’s collected: the onus is on the data processor to process data in a legitimate way.
- rglullis 2y agoCollected does not mean synthesized. Imagine I am in a dating site and want to find out all the people that expressed interest on me. I go then and file a GDPR request, claiming that those that mentions of me is "data collected about me" and therefore I am entitled to it. Someone talking about you, or references about your PII are not PII themselves. To try to claim otherwise is absurd.
- jeroenhd 2y agoI don't believe the "I'm entitled to all messages discussing me because of the GDPR" is correct, though the UK GPDR may be different in a way I don't know about. It's an interesting take (what is "data" anyway? does it include "the CEO thinks <person> is a dick" if that record is kept on company infrastructure?) but I don't think it'll hold up in court. If the author decides to press the ICO to take action, perhaps we may find out one day. That said, scraped data about you definitely falls under GDPR protections even if you never provided any data yourself.
- edent 2y agoI don't think you are correct. It doesn't matter who provides the data. > If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month. https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/ https://cy.ico.org.uk/for-organisations/uk-gdpr-guidance-and... I was asking for how my data was being processed. An email saying "Please perform action XYZ on this specific user" would, I think, fall under that description.
- mark254 2y agoThe next move would be to run a complaint at the local Data Protection Authority - eg. for Austrians https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/.
- GeoAtreides 2y agoHow about HN, is HN GDPR compliant? Can I download my data? No. Can I delete my data*? No. -- *Yes, GDPR requires the ability to delete data: https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://commission.europa.eu/law/law-topic/data-protection/r...
- master-lincoln 2y agoAfaik its OK if this is a manual process on request. If you ask moderator dan via mail I bet he would delete and hand out data of you
- GeoAtreides 2y agoDan refuses to delete data: https://news.ycombinator.com/item?id=23623799 https://news.ycombinator.com/item?id=23623799 Sure, he presents some alternative options, that's all good, but at the end of the day, HN refuses to delete personal data. One day someone with a bone to pick with HN and large enough pockets will test it in the courts. Until then, we must exercise great caution when commenting on HN.
- TeMPOraL 2y ago> One day someone with a bone to pick with HN and large enough pockets will test it in the courts. One day that may happen. I hope HN prevails. I'm a EU citizen and a big proponent of GDPR. However, I also believe in the value of the commons, our shared conversations. I consider the mass deletions on one's entire history of comments to a public forum, to be a very selfish act, harmful to society. I'm very much with 'dang here: community and society at large[0] has a stake here, too. Conversations here are part of public record, they contain wealth of knowledge useful to people who find it in the future. It's not that different from Stack Exchange, really. I'd like to believe GDPR would be fine with a more surgical deletion approach, as 'dang proposes, but I guess we'll have to wait for some court to opine on it. Possibly relevant: I consider this entitlement to have all one's contributions to public boards deleted under GDPR to be the same kind of selfish, antisocial thinking as the whining about LLMs training on one's published Internet comments without attribution (and subsequent desire to delete them, or not to publish anything again on-line). I may be weird, but I don't believe anyone is entitled to all value their labor provides in perpetuity. Society can't function when everyone tries to capture everything for themselves; it works best when people let other use some of the value freely. We need the commons. -- [0] - It's a publicly viewable board, after all.
- donohoe 2y agoThe author of this post makes incorrect assumptions about GDPR and makes bold claims regarding his rights ...GDPR gives me the right to see the data a company holds about me. That includes messages about me stored on their internal systems No. It doesn't give you a right to messages about you. The WP DPO is correct in their response. Its okay to be mistaken but the sense of entitlement here is a bit much. (Not a lawyer, but I've implemented GDPR compliance frameworks and worked with the lawyers closely)
- handelaar 2y ago> No. It doesn't give you a right to messages about you. In the context described (a private organisation holding messages which refer to you personally) this is unbelievably false.
- weinzierl 2y agoGDPR Article 15 says that you (as data subject) have the right to obtain access to personal data being processed by the controller. This can certainly apply to certain types of messages about you but is also limited to the personal data about you. In other words the controller can and usually even must redact the messages. The usual GDPR limitation apply, especially the request can be denied if it is unfounded or excessive. So, while in practice you most likely would not get anything useful out of such a request, I don't think the quote from the original article is as far fetched as you and sibling comments make it sound.
- that_guy_iain 2y agoI think it's quite funny he's complaining about someone else's knowledge of GDPR but links to GDPR UK and not GDPR EU which is he is really referring to. WordPress not being a UK entity in any way, would mean it's outside of GDPR UK. And him being a UK citizen and resident would mean he is not covered under GDPR EU.
- jeroenhd 2y agoThe author lives in the UK, so the UK GDPR is relevant, not the EU one. It doesn't matter that WordPress isn't a UK entity. WordPress does do business in the UK so they need to comply with the UK GDPR as well as the EU one. If they don't want to comply with UK laws, they need to stop doing business with UK customers (or provide free services to UK citizens, but enforcing decisions against companies outside of the country's borders is rather difficult).
- that_guy_iain 2y ago> It doesn't matter that WordPress isn't a UK entity. WordPress does do business in the UK so they need to comply with the UK GDPR as well as the EU one. If they don't want to comply with UK laws, they need to stop doing business with UK customers (or provide free services to UK citizens, but enforcing decisions against companies outside of the country's borders is rather difficult). WordPress.org does not do business in the UK. It doesn't do business at all. It has no UK entity. The courts would have no recourse to enforce anything upon WordPress.org. UK Law does not just apply to everyone. UK law applies to businesses operating within the UK. If you want to test this, go complain to the ICO and they'll tell you that they have no power.
- graemep 2y ago> WordPress.org does not do business in the UK. Wordpress.org is run by Automattic, and the owned by Matt Mullenweg personally: https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-w... Automattic does do business in the UK.
- abbe98 2y agoPrivate messages, notes and such are usually excepted(in the vast majority of cases). Giving out someone else's messages or notes, however... > This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ > The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/ Talk to a lawyer if you are upset.
- Ekaros 2y agoYou most likely have rights to access messages and notes about your account and person in CRM. Or directly related to it. On other hand you likely do not have right to get all emails or chat messages even if your name is mentioned. As this is not discovery like in legal process. This is only my non-lawyer option.
- abbe98 2y agoIndeed that's how I read it too. It's also worth noting that GDPR is implemented separately in each country so it can in fact differ quite a lot country to country.
- belorn 2y agoEu law is not enforced by what is written, but rather what the law writers intention when they worked on the law. If a person try to expand the interpretation of a law then it will be up to them to demonstrate that the expanded interpretation is what was intended. I could make an argument that any database with my personal information is "personal data" and thus i should have a right to get the whole database sent to me, but i doubt a judge would agree. I would unlikely to be what the law writers intended.
- multimoon 2y agoThat seems like a terrible idea for government. “Well actually I meant”, and off went the goalpost into the atmosphere. If a law is so complex that you can’t effectively write it in a locked in medium then the concept of said law is probably flawed.
- edent 2y agoThe UK - and lots of other countries - use "Common Law". https://en.wikipedia.org/wiki/Common_law https://en.wikipedia.org/wiki/Common_law Law is often open to interpretation. Take a look at how most laws are written. It might say "owning a sword is illegal", but then the courts have to interpret whether the sharpened blade you are carrying meets that definition.
- anonymousab 2y agoSpirit of the law vs. letter of the law. You can't go all-in on the letter of the law because language is imprecise and very contextual, and cannot aptly express the intent behind the law perfectly for all edge cases.
- evoke4908 2y agoThat's how American law works. The law as written has very little to do with the law as practiced. Everything comes down to how courts interpret the letter of the law as it relates to the messy reality of meatspace. Writing the law is like writing code. You can attempt to reason through each instruction and apply all sorts of static analysis, but you can't actually be certain it will work until you try to run it in production. The courts are the debugger for legal code. Courts attempt to interpret what the letter of the law means and how it applies to the very specific scenario in front of them. Consider a law that simply states carrying a sword in public is illegal. Without common law, this rule applies in 100% of scenarios unless explicitly stated otherwise. If a foreign dignitary comes and expects officers with ceremonial swords, they all go to jail. We interpret law because the ideal vacuum universe in which the law was written does not have unforseen circumstances. A court applies an interpretation to circumstances to come to the judgement that diplomats are allowed to have ceremonial sabers in their entourage. Think about it some more and ask yourself how a society could function in the long term without the ability to reinterpret law to fit particular circumstances. Every law rigidly applied exactly as written forever into the future. The only option to revise a law is by passing a new one.
- aeuropean12 2y agoWell, is Wordpress.org even managed according to law? Please see this very recent verdict by a California district court: https://techcrunch.com/2024/12/10/court-orders-mullenweg-and-automattic-to-restore-wp-engines-access-to-wordpress-org/ https://techcrunch.com/2024/12/10/court-orders-mullenweg-and... I agree with the question "is Wordpress.org GDPR compliant?", but I think that the scope can be widened: "Is Wordpress.org subject to illegal management?"