Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does HN respect the GDPR?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 107 posts

Re: Ask HN: Does HN respect the GDPR?

#31

Post by mziel »

cedsav wrote: post #19
huac wrote: post #8

Earlier quoted context omitted.

my understanding is that these conditions apply to people in the EU, i.e. that EU residents must be able to delete their content from HN (but HN has no obligation to non-EU residents)

I haven't researched that particular point, but I'm not sure that your HN comments qualify as "personal data" under the GDPR (they'd need to personally identify you).

IP addresses are identified as personal data in GDPR. They're not exposed in the frontend, but HN might use them e.g. for logging.

Also things like deletion, takeout and consent/opt-out need to be supported (provided that HN falls under GDPR).

Re: Ask HN: Does HN respect the GDPR?

#33

Post by [deleted] »

vgf wrote: post #16
aaron-lebo wrote: post #11

Earlier quoted context omitted.

Not to devalue privacy (at all), but if the GDPR is so far reaching that anonymous posts are expected to comply with this, that destroys much discussion. Don't see why that's a reasonable expectation. That's no longer private but public data. If you contribute to public knowledge/discussion, then taking your ball and going home leaves huge gaps in history, the same way you see [deleted] throughout many Reddit threads…

The GDPR only cares about privacy, not quality of internet threads.

[deleted]

Re: Ask HN: Does HN respect the GDPR?

#34

Post by madez »

jakeogh wrote: post #27
teraflop wrote: post #13

Earlier quoted context omitted.

HN certainly processes IP and email addresses of individuals within the EU.

So what? Countries don't get to make laws for other countries. That's the point in having markets of ideas.

But countries decide who to punish for what. One thing might not be unlawful in your country, but in another, and that other country can try to go after you.

That fact is rather boring and well-established. What matters is how the other country enforces the punishment.

Re: Ask HN: Does HN respect the GDPR?

#35

Post by mziel »

vgf wrote: post #30
sctb wrote: post #23

Earlier quoted context omitted.

We're working on it.

For months now. That is not credible. Seems like you actually need legislation as a deadline.

This is the case with most organisations. You have a finite amount of resources and attention, therefore you need to prioritise.

Most GDPR chatter started picking up only in the last few months (of course big orgs have been preparing for the May deadline for a while already).

Re: Ask HN: Does HN respect the GDPR?

#36

Post by emodendroket »

hprotagonist wrote: post #4
emodendroket wrote: post #2

Are they under any obligation to?

The regulation applies if the data controller, an organisation that collects data from EU residents, or processor, an organisation that processes data on behalf of data controller like cloud service providers or the data subject (person) is based in the EU. The regulation also applies to organisations based outside the EU if they collect or process personal data of individuals located inside the EU. According to the…

Right, so the data controller in this case is HN... which is based in the United States. What am I missing?

Re: Ask HN: Does HN respect the GDPR?

#37

Post by zie »

jakeogh wrote: post #27
teraflop wrote: post #13

Earlier quoted context omitted.

HN certainly processes IP and email addresses of individuals within the EU.

So what? Countries don't get to make laws for other countries. That's the point in having markets of ideas.

IANAL but I agree. If an entirely US based company was found guilty in a court of law in the EU, but has no business interests in EU, and has no assets of any kind, then the most the EU could do is ask the US politely to do something about the company FOR THEM. the US would have no requirement (unless there is some treaty around this I'm unaware of) to do anything about it.

If they had assets of some kind in the EU country, they could capture those assets presumably.

But from what I understand with the GDPR at least at the beginning of this, is the EU govt will first try to work with the company to help them comply, before going to such drastic measures as courts and seizing assets.

I imagine the large giants like Facebook, etc will just negotiate through their army of lawyers to minimize the effects of GDPR as much as possible, and delay as long as possible. Before ultimately implementing ~ 1/2 of the best intentions behind the GDPR in about a decade or so.

Re: Ask HN: Does HN respect the GDPR?

#38

Post by M2Ys4U »

cedsav wrote: post #19
huac wrote: post #8

Earlier quoted context omitted.

my understanding is that these conditions apply to people in the EU, i.e. that EU residents must be able to delete their content from HN (but HN has no obligation to non-EU residents)

I haven't researched that particular point, but I'm not sure that your HN comments qualify as "personal data" under the GDPR (they'd need to personally identify you).

"Personal data" is defined quite broadly in the GDPR:

Article 4 states

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

Re: Ask HN: Does HN respect the GDPR?

#40

Post by madez »

akerl_ wrote: post #22
huac wrote: post #8

Earlier quoted context omitted.

my understanding is that these conditions apply to people in the EU, i.e. that EU residents must be able to delete their content from HN (but HN has no obligation to non-EU residents)

How would EU law compel a non-EU entity to delete content based on the residency of the user? As an example of the opposite state, where this does definitely apply: Tarsnap complies with Canadian law around collecting names/addresses for users who are located in Canada, because Tarsnap is operated as a Canadian business. But if Tarsnap were located in the US, it would not be responsible for collecting that informatio…

> But if Tarsnap were located in the US, it would not be responsible for collecting that information from Canadian users.

Responsibility is not defined by gut-feelings, but by law. So, with a suited law, Tarsnap could also be bound in Canada's jurisdiction even if it were located in the US.

Post reply on HN