4 ms·

How about HN, is HN GDPR compliant? Can I download my data? No. Can I delete my data? No. -- Yes, GDPR requires the ability to delete data: https://commi

How about HN, is HN GDPR compliant? Can I download my data? No. Can I delete my data*? No. -- *Yes, GDPR requires the ability to delete data: https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://commission.europa.eu/law/law-topic/data-protection/r...

master-lincoln 2y ago
Afaik its OK if this is a manual process on request. If you ask moderator dan via mail I bet he would delete and hand out data of you
- GeoAtreides 2y ago
  Dan refuses to delete data: https://news.ycombinator.com/item?id=23623799 https://news.ycombinator.com/item?id=23623799 Sure, he presents some alternative options, that's all good, but at the end of the day, HN refuses to delete personal data. One day someone with a bone to pick with HN and large enough pockets will test it in the courts. Until then, we must exercise great caution when commenting on HN.
  - TeMPOraL 2y ago
    > One day someone with a bone to pick with HN and large enough pockets will test it in the courts. One day that may happen. I hope HN prevails. I'm a EU citizen and a big proponent of GDPR. However, I also believe in the value of the commons, our shared conversations. I consider the mass deletions on one's entire history of comments to a public forum, to be a very selfish act, harmful to society. I'm very much with 'dang here: community and society at large[0] has a stake here, too. Conversations here are part of public record, they contain wealth of knowledge useful to people who find it in the future. It's not that different from Stack Exchange, really. I'd like to believe GDPR would be fine with a more surgical deletion approach, as 'dang proposes, but I guess we'll have to wait for some court to opine on it. Possibly relevant: I consider this entitlement to have all one's contributions to public boards deleted under GDPR to be the same kind of selfish, antisocial thinking as the whining about LLMs training on one's published Internet comments without attribution (and subsequent desire to delete them, or not to publish anything again on-line). I may be weird, but I don't believe anyone is entitled to all value their labor provides in perpetuity. Society can't function when everyone tries to capture everything for themselves; it works best when people let other use some of the value freely. We need the commons. -- [0] - It's a publicly viewable board, after all.
    - belorn 2y ago
      https://law.stackexchange.com/questions/32361/does-a-user-have-the-right-to-request-their-forum-posts-deleted#32370 https://law.stackexchange.com/questions/32361/does-a-user-ha... That thread provide a fairly strong argument that hn would not need to delete comments. All hn would need to do is to annomynize/delete the profile of a user.
      - GeoAtreides 2y ago
        That thread provides a summarization of a dutch lawyer blog post, I wouldn't call it a fairly strong argument, merely someone's opinion.
  - multimoon 2y ago
    The best practice is to just not post something on the internet that you don’t intend to be archived and live forever. I feel pretty strongly that it isn’t the place of a government to police non-critical data (read: things that aren’t financial related).
  - amszmidt 2y ago
    "Refuses" --- that is not what I read in the Dan's comment, on the contrary. Deleting specific comments is just fine. The GDPR doesn't mean you can delete everything you have written on the Internet wholesale, it means to be forgotten .. and renaming an account is exactly in line with that.
jtylr 2y ago
There doesn't need to be a self-service mechanism, you just need to be able to ask. Skimming the privacy policy indicates you should be able to email `privacy@ycombinator.com` with your request.
Etheryte 2y ago
The GDPR only applies personal data (name, ID number, IP address, etc), not all data in general. Your comments on a forum are generally not personal data.
- GeoAtreides 2y ago
  Not a lawyer, but I think they are my data (as per my link in my og comment). Sadly can't afford to test it the courts, but someone eventually will.
  - Etheryte 2y ago
    They most definitely are not, you're misinterpreting the link you're referring to. > The General Data Protection Regulation (GDPR) gives individuals the right to ask for their data to be deleted [...]. This does not mean any data, it only means personal data as described under GDPR. Why is this the case? Because the GDPR is explicit that it only applies to personal data, that's the scope of the whole regulation. I recommend reading the text of the regulation itself, it's fairly digestible. The legal text uses "personal data" throughout to avoid the ambiguity, unfortunately many summaries do not. Article 1 of GDPR: > 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
    - GeoAtreides 2y ago
      Please read: https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://commission.europa.eu/law/law-topic/data-protection/r...
      - Etheryte 2y ago
        I've read the link, it doesn't say what you think it says. Similarly, the original legal text of the regulation doesn't agree with you. So what's your point exactly? Even the title of the page you're linking to says it's only talking about personal data.
amszmidt 2y ago
> *Yes, GDPR requires the ability to delete data: Under specific circumstances. It could be easily argued that deleting comments would fall under the first example of the link you posted -- unless you're a minor. The GDPR doesn't require any means to download data though, and it is mainly for PII.

How about HN, is HN GDPR compliant? Can I download my data? No. Can I delete my data*? No. -- *Yes, GDPR requires the ability to delete data: https://commi

master-lincoln 2y ago

Afaik its OK if this is a manual process on request. If you ask moderator dan via mail I bet he would delete and hand out data of you

GeoAtreides 2y ago
Dan refuses to delete data: https://news.ycombinator.com/item?id=23623799 https://news.ycombinator.com/item?id=23623799 Sure, he presents some alternative options, that's all good, but at the end of the day, HN refuses to delete personal data. One day someone with a bone to pick with HN and large enough pockets will test it in the courts. Until then, we must exercise great caution when commenting on HN.
- TeMPOraL 2y ago
  > One day someone with a bone to pick with HN and large enough pockets will test it in the courts. One day that may happen. I hope HN prevails. I'm a EU citizen and a big proponent of GDPR. However, I also believe in the value of the commons, our shared conversations. I consider the mass deletions on one's entire history of comments to a public forum, to be a very selfish act, harmful to society. I'm very much with 'dang here: community and society at large[0] has a stake here, too. Conversations here are part of public record, they contain wealth of knowledge useful to people who find it in the future. It's not that different from Stack Exchange, really. I'd like to believe GDPR would be fine with a more surgical deletion approach, as 'dang proposes, but I guess we'll have to wait for some court to opine on it. Possibly relevant: I consider this entitlement to have all one's contributions to public boards deleted under GDPR to be the same kind of selfish, antisocial thinking as the whining about LLMs training on one's published Internet comments without attribution (and subsequent desire to delete them, or not to publish anything again on-line). I may be weird, but I don't believe anyone is entitled to all value their labor provides in perpetuity. Society can't function when everyone tries to capture everything for themselves; it works best when people let other use some of the value freely. We need the commons. -- [0] - It's a publicly viewable board, after all.
  - belorn 2y ago
    https://law.stackexchange.com/questions/32361/does-a-user-have-the-right-to-request-their-forum-posts-deleted#32370 https://law.stackexchange.com/questions/32361/does-a-user-ha... That thread provide a fairly strong argument that hn would not need to delete comments. All hn would need to do is to annomynize/delete the profile of a user.
    - GeoAtreides 2y ago
      That thread provides a summarization of a dutch lawyer blog post, I wouldn't call it a fairly strong argument, merely someone's opinion.
- multimoon 2y ago
  The best practice is to just not post something on the internet that you don’t intend to be archived and live forever. I feel pretty strongly that it isn’t the place of a government to police non-critical data (read: things that aren’t financial related).
- amszmidt 2y ago
  "Refuses" --- that is not what I read in the Dan's comment, on the contrary. Deleting specific comments is just fine. The GDPR doesn't mean you can delete everything you have written on the Internet wholesale, it means to be forgotten .. and renaming an account is exactly in line with that.

jtylr 2y ago

There doesn't need to be a self-service mechanism, you just need to be able to ask. Skimming the privacy policy indicates you should be able to email `privacy@ycombinator.com` with your request.

Etheryte 2y ago

The GDPR only applies personal data (name, ID number, IP address, etc), not all data in general. Your comments on a forum are generally not personal data.

GeoAtreides 2y ago
Not a lawyer, but I think they are my data (as per my link in my og comment). Sadly can't afford to test it the courts, but someone eventually will.
- Etheryte 2y ago
  They most definitely are not, you're misinterpreting the link you're referring to. > The General Data Protection Regulation (GDPR) gives individuals the right to ask for their data to be deleted [...]. This does not mean any data, it only means personal data as described under GDPR. Why is this the case? Because the GDPR is explicit that it only applies to personal data, that's the scope of the whole regulation. I recommend reading the text of the regulation itself, it's fairly digestible. The legal text uses "personal data" throughout to avoid the ambiguity, unfortunately many summaries do not. Article 1 of GDPR: > 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
  - GeoAtreides 2y ago
    Please read: https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://commission.europa.eu/law/law-topic/data-protection/r...
    - Etheryte 2y ago
      I've read the link, it doesn't say what you think it says. Similarly, the original legal text of the regulation doesn't agree with you. So what's your point exactly? Even the title of the page you're linking to says it's only talking about personal data.

amszmidt 2y ago

> *Yes, GDPR requires the ability to delete data: Under specific circumstances. It could be easily argued that deleting comments would fall under the first example of the link you posted -- unless you're a minor. The GDPR doesn't require any means to download data though, and it is mainly for PII.