Ask HN: Is HN GDPR compliant?

#1

Post by tschellenbach » Mon, Apr 30, 2018, 2:12 AM UTC

After reading this post https://news.ycombinator.com/item?id=16954306 I thought about the small sites I like to visit. Things that started out like hobby projects such as Lobsters and HNews. I wonder, is HNews GDPR compliant? It doesn't really seem to be. Some topics mentioned in articles about GDPR:

- Ability to export data - Ability to delete your account - Disclose tracking (the voting ring detection must do some sort of tracking)

Re: Ask HN: Is HN GDPR compliant?

#2

Post by KempFood » Mon, Apr 30, 2018, 2:43 AM UTC

No, it's not.

Re: Ask HN: Is HN GDPR compliant?

#3

Post by scottmcdot » Mon, Apr 30, 2018, 2:50 AM UTC

Regarding the guidance for Australian businesses and GDPR [1], if there are a few users based in the EU, would their whole website need to comply?

[1] https://www.oaic.gov.au/media-and-speeches/news/general-data...

Re: Ask HN: Is HN GDPR compliant?

#4

Post by nodesocket » Mon, Apr 30, 2018, 2:52 AM UTC

Probably not. I really have mixed emotions about GDPR being a SaaS founder. It seems overstepping and heavy handed that the EU can enact laws that affect American's and American companies. The EU can do what it wants, but generally I am against regulation as it promotes bureaucracy, stifles innovation, and creates fluff and burden's especially on small companies such Chief Data Protection Officer and Chief Data Officer.

Re: Ask HN: Is HN GDPR compliant?

#5

Post by cyberferret » Mon, Apr 30, 2018, 2:57 AM UTC

Upon cursory inspection, the single fact that user don't seem to be able to delete their account data from here would make it not compliant. Similarly the inability to delete posts after a certain time may also conflict with the data removal stipulation of GDPR.

But as a corollary to that, GDPR laws seem to only apply where there is data that can personally identify a user. The usage of nicknames and throwaway accounts on here may mean that GDPR requirements may be able to be ignored as long as there is no piece of data that can be linked back to an identifiable user (such as an email address in their profile etc.)

Note: IANAL - So please take this as my opinion, and not a legal finding.

Re: Ask HN: Is HN GDPR compliant?

#6

Post by lamlam » Mon, Apr 30, 2018, 3:00 AM UTC

One important thing to not about some of these points is that they don't have to be made easy for users. For example, in relation to "Abilty it export data", there doesn't necessarily need to be a feature on the website for it to be compliant. They simply need to do it if you ask. So if that means having someone manually run a query to get a data dump every time someone asks, it's still considered compliant.

Of course that doesn't actually scale. That's why most all the big players are providing export features.