Hacker News Reader

I suggest you read about the new European General Data Privacy Regulation, which comes into force in May 2018, and requires you to allow users to (a) export and (b) delete all personal data they gave you, including messages, posts, etc. Violation will be punished with a fine of up to 20 Million EUR or 4% your global revenue, whichever is higher. This law will apply to all sites that have EU customers, no matter where the site is located, and will be enforced globally (through banks assisting with account freezes, etc).

Where did you get that "messages and posts" are included in data that falls under the regulation? Not contesting, genuinely interested. I was under the impression it only covered personal data in a very strict sense (names, addresses, personal info like gender, etc)

The GDPR, as far as I was told when asking a lawyer, covers anything that could contain personal information.

If a user chooses to put their SSN into an HN post, then that post is now also personal data. Or their address. Or if they write in a post that their parent has a specific kind of cancer.

Unless you can guarantee that no post contains such data, you should assume them to be personal. And no ToS rule "don't post personal data" will protect you.

Delete, or make it not findable by other normal user accounts? How is deletion enforcable or provable? Are government agents allowed to enter your premises or those of your data centre(s), and gain complete and unrestricted access to all physical disk media to do a full scan to prove or disprove any given allegation of failure to delete?

There are no government agents entering your premises, but if it turns out you had the data still (and even if it's an employee telling the police), you're on the hook for up to 4% global revenue for the time frame in which you did it, or 20 million EUR, whichever is higher.

So you absolutely don't want to do that.

Google handles this by, over the course of a few weeks, even deleting all traces from its backups and caches.

> You can't take back emails or phone calls and you can't ask people to take your name or information out of a book or magazine once it's been available for years.

None of those things are going to turn up in a Google search 20 years from now - there's a relatively limited number of people who are going to dig up this information and send it to your employer, or use it to commit crimes against you.

Privacy is not binary, as much as it's nice to think about it that way - something I've only told 2 people I trust is decidedly more private than something I've published to the world, and something I've published online and then removed is more private than something I've left up.

Tell that to the EU.

One of the primary reasons I don't like posting here or on services like you describe is because I cannot delete anything. Maybe you've enough users who don't care about that but it should be taken into consideration that many people will not participate.

You'd be therefore trading direct communication for archived communication and I'm not sure that's more valuable.

> That's why my ideal solution has always been to basically say 'by signing up with this service, you grant us an irrevocable, unlimited right to use your posts for the purposes of the community' with a nice 30 minute or so editing window set for content.

Soooo, HN?

There's a significantly higher barrier to having your personal information show up in a book or magazine (eg editors). People make stupid mistakes on social websites on the time.