Ask HN: Will my comments/topics on HN be deletable under the GDPR law?

https://news.ycombinator.com/item?id=16751656

by ggregoire • 8 years ago

38 52 8 years ago

news.ycombinator.com

Right now we can't delete anything.

cjbprime3• 8 years ago

The law isn't in effect yet.

But when it is, being able to delete comments by emailing the admins and asking for them to be deleted sounds like it would be in compliance with the law.

I don't know any specifics, but I expect they would probably do that for you anyway, before the law, too.

unicornporn3• 8 years ago

The law isn't in effect yet.

Sort of, kind of.

http://dbsdata.co.uk/blog/gdpr-2018-deadline-red-herring/

trevyn2• 8 years ago

So what’s the deal with jurisdiction? YC is a US entity and GDPR is an EU law.

jakeogh5• 8 years ago

There is none. Unless YC has EU assets, they could go after those.

huddo121• 8 years ago

My understanding of it is that HN/YCombinator would also have to be targeting EU customers directly, such as by offering the service in EU languages (english probably wouldn't count) or offering prices in EU currencies.

kiliankoe• 8 years ago

It applies to all EU citizens, no matter where your operations are based. It would make sense though for most companies to just treat everybody as an EU citizen for GDPR. Unless apparently you're Facebook and don't want to...

trevyn2• 8 years ago

Ok, so I’m a US entity without EU presence and I violate EU law. Explain how this would impact me?

venning• 8 years ago

Questions I've had about this:

How does the allowance of comment/submission deletion affect HN being perceived as a "permanent record"? I've always found this aspect of HN to be important to me.

If comments can be deleted selectively, what effect does that have on the permanent record? How many users would be tempted to write something they don't want recorded permanently simply to judge responses before they delete the comment later? (As opposed to requiring that all comments for a user be deleted together, which would likely discourage deletion to remove specific comments.)

Would this give rise to third-party "comment recovery" services that scrape something like archive.org (assuming it is less affected by the GDPR) or maintain their own records to piece together comment threads with deleted comments? Similar to services that archive tweets that might get deleted.

krapp• 8 years ago

How does the allowance of comment/submission deletion affect HN being perceived as a "permanent record"?

Has Hacker News ever presented itself as a service that maintains permanent records for archival sake, or merely one that chooses not to delete comments? I don't think they have an obligation to serve a purpose they never intended to serve.

How many users would be tempted to write something they don't want recorded permanently simply to judge responses before they delete the comment later?

Users do that now - there is an edit and delete window for comments, it just has a limit.

Would this give rise to third-party "comment recovery" services that scrape something like archive.org (assuming it is less affected by the GDPR) or maintain their own records to piece together comment threads with deleted comments?

Probably, such services exist for imageboards.

dyu3• 8 years ago

HN may cite legitimate business interest and not oblige in deletion.

A more extreme example can be that when you perform a deletion, do you also deep delete from logs and backups of logs? What if you need to keep them for audit and forensic purposes?

Edit: citing legitimate business interest does not necessarily mean it will succeed. Courts will have the final say. EU likely will not enforce smaller entities so soon. We may need to see a few court decisions or better guidelines before we get a better idea how to navigate through GDPR.

mankash6668• 8 years ago

GDPR rules do not apply to YC - a US company.

dyu3• 8 years ago

I thought the legal side would work in a similar fashion as EU-US Privacy Shield?

unicornporn3• 8 years ago

That generalization is just plain wrong.

Article 3 of the GDPR says that if you collect personal data or behavioral information from someone in an EU country, your company is subject to the requirements of the GDPR. Two points of clarification. First, the law only applies if the data subjects, as the GDPR refers to consumers, are in the EU when the data is collected. This makes sense: EU laws apply in the EU. For EU citizens outside the EU when the data is collected, the GDPR would not apply.

It's more complicated than that though. Just Google and you will find some valuable information. https://www.forbes.com/sites/forbestechcouncil/2017/12/04/ye...

BjoernKW• 8 years ago

If that US company wants to do business with people or businesses located in the EU GDPR rules absolutely do apply.

Yes, providing a free website can qualify as "doing business", too, for example if the company running the website uses it to attract potential customers, which arguably is one purpose of Hacker News.

drinchev• 8 years ago

AFAIK logs should not contain personal data at all and backups ... you need to figure out a way to delete the already deleted user data when you restore a backup.

Interestingly enough. When I request to delete my data from HN, I would expect HN to send algolia (3rd party) a request to do so too. It should all propagate to even Google's search.

That's all like too complicated to implement and here ( at least ) in Berlin companies are in huge trouble about the details.

mankash6668• 8 years ago

Unless some subsidiary of YC is incorporated in the EU, none of the GDPR rules affect YC (a US company).

Additionally, for emerging Saas companies it would be wise to avoid an EU subsidiary, to lower the cost of GDPR compliance

hekfu• 8 years ago

IANAL but I think it's more complicated than that...IIRC if you want to do.business in the EU, you need to comply. Not sure if.you can argue that HN does 'business' though

Ninn2• 8 years ago

HN and YC does do buisness, amongst other things display and rent out advertisement space that is both displayed to, and on behalf od eu citizens and companies?

Ninn2• 8 years ago

Categorily false. GDPR applies based on your users location, not the website/buisness.

Please consider not stating things as facts that you havnt bothered to research.

mnm1• 8 years ago

And how do you suppose they would enforce this law on a US only company? An unenforceable law is no law at all.

mankash6668• 8 years ago

And you are stating theories as facts. If GDPR holds on American businesses with no legal presence in the EU, then Chinese censorship laws apply to us companies outside China. Or do they?

majewsky• 8 years ago

I think the more interesting question is: Will my comments on HN be deletable on archive.org under the GDPR law?

gus_massa• 8 years ago

I think the more interesting question is: Will my comments on HN be deletable on archive.org under the GDPR law?

And what happens if someone quotes my comment?

orf• 8 years ago

I sense a lot of misplaced patriotism here, with many comments reeking of almost outrage: "how dare the EU tell us what to do on our soil! We are Americans damnit, this makes us better than other people and allows us to selectively ignore other laws!"

Well, the USA has been doing this to other countries for decades. Your failure to self regulate the protection of the huge volumes of personal data you like to collect plus your governments love to hoover this up has led to this. Deal with it, and be glad that at least someone is legislating this crazy situation we find ourselves in.

sb8244• 8 years ago

There's a spectrum and being on either extreme of it isn't good. We're going to simultaneously find ourselves on both extremes and not central at all.

lucideer2• 8 years ago

It may depend heavily on the content of the comment, but I would guess it wouldn't constitute data about you. Even your username is anonimisable by you.

throwaway2016a2• 8 years ago

Username is only anonymized on initial signup. There is no way to anonymize a username that already was set that I know of.

lucideer2• 8 years ago

ability to change username would be a nice feature

throwaway2016a2• 8 years ago

I'd be happy with just being able to redact my username (not this one). I was stupid and registered originally with my real name in my username and I would love to fix.

Alas, I'm not a EU citizen so even sites that do afford GDPR protection probably won't respond to requests from me. Like Facebook [1].

[1] https://techcrunch.com/2018/04/04/facebook-gdpr-wont-be-univ...

WilliamMayor• 8 years ago

The right to erasure is not absolute, it only applies in certain circumstances. Here's the UK ICO's advice on it: https://ico.org.uk/for-organisations/guide-to-the-general-da...

In the list of "When does the right to erasure apply?", I'm not sure which one you would argue if you wanted to have your HN comments deleted.

1. The data is still necessary for the original purpose

2. HN doesn't rely on consent for this data (I don't think?)

3. I think HN are using legitimate interests, so you could try to object to the processing. I think HN could argue that their legitimate interests override the objection?

4+ Don't apply

So the only one that might work would be point 3. IANAL but it is in HN legitimate interests to keep the comment.

I'm not certain, it seems a bit woolly now I've written it down. It might depend on the seriousness of your objection.

Overall though I think it's important to remember that the right isn't absolute, you can't just have all your data deleted whenever you like. That's not the point of the law.

mankash6668• 8 years ago

All those confidently stating that GDPR applies to YC despite it not being a EU registered corporation are guessing at best. None of this has been tested in litigation by US courts.

If US companies (without a EU legal/corporate presence) are beholden to EU law, then US companies are beholden the Chinese censorship laws

ggregoire2• 8 years ago

I have to repeat the same response I already gave you:

Makes no sense at all and the analogy with the Chinese censorship laws is really bad (not sure why I'm reading this analogy again and again on HN). GDPR holds on US businesses only for the EU users. If they don't have EU users they don't have to care about the GDPR. US businesses can have different set of rules for the US and EU market (that's what Facebook plans to do about the GDPR). The GDPR doesn't apply for the US market and the US users. Also US companies can limit their service to the US market if they don't agree with the GDPR.

mankash6668• 8 years ago

I don't know why you confidently state these things as fact without presedence in litigation in US courts. US companies today that do not differentiate and demarcate their users based on location needn't start doing this, because the internet has no boundaries, and EU laws on EU citizens do not hold or apply to US companies that do not care for the location of the user within their service.

Again - your opinions are just as valid as mine because there isn't a precedent in US (federal) courts. Stop pretending like your 'opinion' is fact

mankash6668• 8 years ago

Maybe third time will be the charm. Most respondents here (including me) would like GDPR applied to all companies as it protects end users.

However, US companies with no legal/corporate presence in the EU are ONLY bound by US law.

Take the case of EFF vs Australian patent troll [1]. Though EFF was sued in Australian court under Australian law, it didn't matter because EFF was an American company.

This holds true, otherwise China could sue US media under Chinese law on the pretext of said media being available within China via the Internet.

Similarly, for the EU to go after non EU corporate/legal entities, it'll need to implement a GDPR firewall, much like China's great firewall. It simply cannot push the onus of GDPR compliance on non EU entities with laws that it can't apply on them

[1] https://www.eff.org/deeplinks/2017/11/court-rules-effs-stupi...

Ask HN: Will my comments/topics on HN be deletable under the GDPR law?

Related Stories