Comment by _m7bj | Hacker News Reader

Comment by _m7bj | Hacker News Reader

Yes and no. I can't lie, I was really hoping for a significant company to be put up against a wall and shot, maybe a major retailer that won't let you check out online without giving a phone number or whatever. The notion of data being a toxic asset[1] still hasn't really sunk into the higher ranks of most large orgs.

However, I've found GDPR deletion requests to be a pretty strong cudgel. For the last 10 years or so I've been sending deletion requests for accounts when I no longer need them. Prior to GDPR, about 50% of responses would be along the lines of "in the nicest possible way, we don't care about you enough to do that so please fuck off". Reading between the lines, I assumed that about 50% of websites were implemented poorly and didn't properly support deletion.

Post GDPR, all but one request have been given a polite "we have done as you have requested, we hope to see you as a customer again". GDPR has both legitimized the process of requesting that your data has been deleted after you're finished using a service, and has legitimized the concerns of all those developers who were never able to get engineering time to properly support account deletion.

So it's been a success, it could be succeeding more but I'm not unhappy. I would still like to see at least one company get ICBM'd in order to remind larger entities that they've got responsibilities to society too, not just their shareholders.

[1] https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

Can you call it "your data" if it is not being stored on your hard drive?

If I write your birthday on a piece of paper is it "your" birthday?

It's his birthday, but he definitely doesn't own your piece of paper now.

Nor do I own the banks hard drives, but I do own the money stored on them.

Much like how if I leave my phone in a taxi, either deliberately or accidentally, I don't own the taxi, but I do still own the phone.

I think the analogy falls apart when you consider the movement/creation of singular objects (like your phone or your money) versus new/copied objects (a copy of his birthday on your singular piece of paper).

If you create a replica of a taxi you rode in, you own that copy.

If you take a photo of someone, you own that photo.

If you write that person's birthday down on a piece of paper, you don't own their birthday now. You own the piece of paper with their birthday written on it, and they have no claim to that paper or what's written on it.

If you go through someones wallet and write down all the details required to open a bank account in their name, you do not suddenly own all those details, and you may not do with them whatever you wish as if you did.

Opening a bank account using those details is identity theft, because they are not /your/ details. No one cares if you owned the paper you wrote them down on.

Yes, you can. That is a large part of the point of the GDPR; personal information on third parties is no longer merely a corporate asset.

Thanks to GDPR, if the data personally identifies you then you sure can.

Thanks to GDPR, yes I can.

Comparison: The bank's hard drives hold my money, but it's still mine and not theirs.

That's just colloquial terminology. GDPR terminology is "personal data" concerning or referring to the "data subject". That stalls the ownership question. And yes, when "personal data" regarding an EU "data subject" is stored on someone else's hard drive, that "data subject" has certain rights in the EU.

These are colloquially interpreted as "you have rights to your data". Naturally, your address is not generally copyrightable (another notion of ownership of data) but it can be "personal data" that relates to you.

Reply on news.ycombinator.com