Hacker News Reader

Comment by jlpcsl | Hacker News Reader

Wow wow, Isn't this the violation of the Europen GDPR privacy laws. If you deletd it then they should actually be deleted, otherwise you are violating the laws.

View on HN

Yes and the irony is I was in Oslo today, showing to people within the EU our PoC demo for IKEA.com - on how we can provide recommendations with no third party data - and with the idea of consumers controlling exactly what is used to provide it - including the right to delete it all.

This is the way we're going - totally the opposite way.

I want to go with you. The US is so awful for privacy, not just at an administrative level, but we have too many citizens that do not care ('nothing to hide') and believe in an internet that can only be funded by giving up privacy. (Just look to HN for many "well, how else do you pay for it?!" arms tossed up comments)

For a people that seem to think we're synonymous with 'freedom,' the paths we choose sure seem to indicate a fucked up vision of what 'freedom' looks like going forward.

Too many attitudes feel defeated and resigned to abusive things today.

Is your poc or a further description of it up online anywhere?

Not yet - we built it in 3 days, as a Chrome extension (so it works on IKEA.com) on top of our Knowledge Graph as sessionless - it was part of the OntoCommons innovation lab hackathon (https://www.linkedin.com/posts/michelamagas_ontology-commons...)

I am planning on using my EU citizenship to have reddit wipe my history completely.

I believe you can absolutely revoke your consent to Reddit processing your data and demand that they remove any and all PII from their records. That will force them to go through your entire comment history and identify any such information.

Most reddit posts wouldn't be considered PII and I'm not sure the 'delete' function on a reddit post constitutes a GDPR removal request (it's not clear how this user purged their data).

The reddit FAQ around deleting your account[0] suggests that they'll just 'dissociate' your posts from your account (so the user says [deleted]) and remove your account data which should be fine for GDPR purposes.

This[1] support page says mods/admins can't recover your deleted posts for you but stops a little short of saying that it's impossible for them to do it for themselves.

So pretty scummy behaviour but I don't think anything they're doing is illegal (IANAL!).

[0] https://support.reddithelp.com/hc/en-us/articles/36004304793... [1] https://support.reddithelp.com/hc/en-us/articles/36004348345...

There must be some legal justification for reddit doing this.

https://gdpr-info.eu/art-17-gdpr/

Maybe Reddit users don't qualify for "Right to Erasure" because Reddit is still going, their data is being used, they technically didn't revoke "consent" and so on?

For instance, Article 9 in relation to Article 17 seems pretty solid:

> the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing

> Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

But perhaps deleting an account + posts does not qualify as revoking consent?

I dunno anything about GDPR, but Reddit would have to be confident about every condition in Article 17. It makes me think these undeletions are a considered decision, not a knee jerk response.

That is not how that works.

The right to keep data beyond when a user requests it's deletion is contingent on it being needed for ongoing business requirements like tax and other audit requirements, not for content.

It's not possible under GDPR to automatically license user submitted content via a ToS or something. If you want to keep content beyond when a user clicks a delete button you would need a contract that provides reasonable compensation for licensing that content.

Does the button to delete a Reddit account+posts absolutely qualify as revoking consent?

(I am not trying to be combative, I am just unfamiliar with GDPR)

The GDPR itself is purposefully vague but is generally interpreted favouring the user so I would err on the side of it being revocation. We have always treated this way in SaaS startups I have worked at and I don't imagine you would get a more charitable reading of that as a social network an in EU court.

That said. IANAL.

Add that to the minefield of GDPR issues Reddit has to confront. They've provided the whole Reddit comment corpus to researchers, several located in Europe, though the PushShift dataset. There are no real privacy controls on that dataset (anyone can query it) and apparently no way to process removal requests.

Information is money and power. No one deletes that.

Is it?

I understand that the GDPR allows you to request deletion of your private data, but content you’ve published isn’t quite the same. At the very least, Reddit’s TOS claim a perpetual irrevocable license to that content

Does the GDPR have a separate provision for requesting the deletion of published content, or are people just assuming it falls under the private data rules?

Reddit is up against the laws that even bigger assholes had made to fuck over people who use copyright material without explicit permission...

Most of it isn't. GDPR covers only personally identifiable data, not all user-related data. Unless you doxxed yourself in your comment, there's no personally identifiable data in those.

I wonder if there is a legal difference between submitting an official GDPR request for deletion and simply hitting the delete button on the platform itself.

Reply on news.ycombinator.com