Hacker News Reader

Comment by Spivak | Hacker News Reader

But it’s a chat application, those messages aren’t owned by just the user that authored them. Even if a user deletes their account I should be able to go back in my chat history and find their messages and know it was them.

It would be stupid if someone closing their cellular account would somehow reach into my phone and delete their contact, their messages, and replace their phone number with all zeros and this is semantically the same, the implementation shouldn’t matter.

If you send a message to a group chat those messages are now owned collectively by the group and individually by each member, the gpdr is forcing companies to delete my data because someone else asked to delete theirs.

View on HN

I would say there's a real semantic difference between whether those files are stored and managed on your device, or on the provider's servers. If they're only on your device, have fun with them, but they are not allowed to store or touch data that I (as the sender) have instructed them to delete.

I agree with you in principle and I think that the EU is basically extorting American companies, but in your example all that information is stored in your phone, while in this case the information is stored in Discord's servers.

Right which to me is a distinction without a difference. If you and me are both Gmail users and you send me an email then delete your account should Gmail have to reach into my inbox and delete your emails? They’re on Google’s servers after all.

There is definitely a difference between PII data of different users being distributed rather randomly across personal devices vs. it being consolidated within a single company which can then proceed to use that data for all sorts of purposes you may or may not have agreed to.

It's about technical capability.

In this case, Discord is a very centralised service. They store all of the messages centrally, so can easily comply with the request.

Other services like email may not be able to do that, so they could use that as a defence when asked why they aren't deleting all data.

There's a spectrum of things I can share with you over gmail. Currently, if I share an email with some formatted text and attachments up to 25MB, then it's yours to keep, but anything above 25MB is shared as a link to a Google Drive upload, which remains under my account, and I can always delete or modify.

But I don't see any particular reason for where exactly the line between the two should be - why wouldn't it be that I could make anything I shared with you ephemeral, a-la Snapchat? And going back to email, it was actually MS Exchange who have supported the option to "Recall this message" [0] for many years, while gmail decided to not implement anything like that.

[0] https://support.microsoft.com/en-us/office/recall-or-replace...

Interesting; for me line seems fairly thick at "ownership" level (which just shows we may have different assumptions:)

My thoughts:

If it's in my inbox (whether on my physical phone, or hosted for me by a service provider), I own it and I get to control it regardless who sent it / how it got there (as long as other legal pre-requisites are met, i.e. not child porn etc)

If it's in my outbox, and I want to delete my account, THOSE instances of those artifacts should be removed, whether from my physical phone or by the service provider hosting them for me. If I've sent them to others, fair game, they own THOSE instances; but I expect the service provider to remove, upon my request, the artifact instances I solely own.

Does GDPR distinguish these cases? Personal information is fine to keep on an individual's computer, but not on a company computer? What about personal cloud storage like Google Drive (company's servers, individual's data)?

American companies are free to not do business within the EU. If they do, they must comply with the law. Same with USA, China, Russia, etc.

Yes but if the law was “Fuck You America Act: 5% of global revenue from US based companies goes to us because we can” then the US government might have opinions about that when it comes to trade negotiations.

The question is whether this law is closer to fuck you than it is reasonable regulation of bad behavior.

What about users from the EU who want to use those services despite the EU not liking them? Fuck them, right?

if they want it to work as you posit, they should not save all the date in Discords systems, but create a distributed chat system.

What’s the difference between Discord and two Gmail users communicating? The data is all on Google’s servers.

If we work on a Google Doc together should deleting your account delete my document as well? They’re both on Google’s servers and on the backend we don’t have separate copies.

Reply on news.ycombinator.com