Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Eve Online corporation has been hit with a GDPR request from an ex-member

massivelyop.com

Post reply on HN
Print view View original

91–100 of 141 posts

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#91

Post by geocar »

zizee wrote: post #27

As much as I like the idea of "right to be forgotten", it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills. This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests. They will be forced to eit…

> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten?

You record that these people need to be scrubbed if you restore backups, and you delete old backups.

The ICO has excellent guidance on this and other subjects:

https://ico.org.uk/for-organisations/guide-to-data-protectio...

> This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests

I can't understand what your question is.

There's absolutely no reason someone can delete spam from their public forum, but can't delete people's phone numbers from items that are pointed out to them.

If they have no search capabilities, and don't use a search capability, they're not required to create one.

The GDPR is extremely easy to comply with- European companies have been doing it for a long time (before it gained the force it has now) because it's largely a unification of existing data protection laws.

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#92

Post by davidgerard »

zizee wrote: post #27

As much as I like the idea of "right to be forgotten", it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills. This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests. They will be forced to eit…

quick guide for sysadmins: what I actually do

https://reddragdiva.dreamwidth.org/606812.html

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#93

Post by Cthulhu_ »

dmitriid wrote: post #8
dleslie wrote: post #6

Earlier quoted context omitted.

The hobbyists may not have access to do so. Perhaps their site is on a VPS or worse, a SAAS product? And why should a Canadian running a site on American servers have to fear EU law? Why isn't it the EU citizen's responsibility to know, understand and abide by the rules and regulations of the countries they're visiting online?

Why should a European citizen abide by the laws of a different country (which may be illigal in their country BTW)

They shouldn't, UNLESS they are physically in said country, do business in said country, or use services based in said country.

Re: GDPR, if a US or Canada based company does business in Europe, or has data for European users, they have to comply to European laws. Just like European online services have to comply with e.g. DMCA takedown requests if they want to do business in the US, or online services have to comply with Chinese censorship laws if they want to do business in China.

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#94

Post by geocar »

tql wrote: post #90

So the GDPR is only about personal data? What are my responsibilities if I run a chan, i.e., I store no personal data about my posts other than the IP address where they originated? What if I use some tracking technology such as a cookie or localStorage to identify unique browsers regardless of their IP address?

You have to make it clear to people that you're using these technologies and how long you keep their data. You should also explain how you keep this data safe.

If you suffer a data breach you have to disclose this, and you are potentially liable for it if you could've protected users from that breach by technological means (applying patches, salting passwords, encryption, and so on). If your breach includes too much personal data() this could be serious.

If you think you want to keep data forever, then your liabilities for that data extend forever. You should consider if this is really what you want, or if you might want to simply delete old backups and scrub identifying information after some time.

() The regulator will evaluate this by considering how the people that personal data is about will be affected. This is a difficult question to ask -- a chan user might at worst suffer potential embarrassment being linked to posts, so I suspect the regulator will view loss lightly, unless it could easily and reasonably be prevented.

The ICO has really good guidance about this on their website:

https://ico.org.uk/for-organisations/business/

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#95

Post by geocar »

fhrow4484 wrote: post #10

What's interesting, and pointed out by a Reddit comment: https://www.reddit.com/r/legaladvice/comments/acsdf3/comment... There's no way to identify that the person making the request is who he/she says he/she is. The irony is that for services like Facebook, Facebook could ask for a scan of your id/passport to confirm it's you, (and would it also have to keep that scan saved somewhere in case it later needs to prove…

> But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?!

That's one way to do it.

Another way would be to ask them to log in and set some preference (change their info field or name to "DELETE ME") or something like that.

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#96

Post by Cthulhu_ »

tql wrote: post #90

So the GDPR is only about personal data? What are my responsibilities if I run a chan, i.e., I store no personal data about my posts other than the IP address where they originated? What if I use some tracking technology such as a cookie or localStorage to identify unique browsers regardless of their IP address?

Then you couldn't comply with takedown requests (and thus can safely disregard them) because you don't know what content belongs to what user, and you can't even be sure that the person making the request is actually the one that posted the information on your chan.

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#97

Post by geocar »

scarejunba wrote: post #71

I wonder if there's business in GDPR trolling websites. Does it count as extortion if you give someone personal data and then say they must delete it or pay you money to not kick up a fuss. Honestly, it sounds like it should be legal. Like the way ADA or CEQA trolling is. After all, that provides a valuable function.

Yes. And I think there's an astroturfing movement from large data warehouses in the US that attempt to add confusion by talking about weird cases that don't really exist.

The GDPR is actually quite simple to comply with for most people: European businesses have been doing it for years since the GDPR is largely the unification of various data protection regulations.

I suspect as more people learn that, that trolling business will fall by the wayside...

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#98

Post by gaius »

geocar wrote: post #91
zizee wrote: post #27

As much as I like the idea of "right to be forgotten", it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills. This will have a silencing effect for people wanting to operate non-profit sites as they won't be able to afford to comply with such requests. They will be forced to eit…

> On a semi-related note: if you are a small SASS operator wanting to comply with such requests, what are you meant to do about your DB backups that contain data that is meant to be forgotten? You record that these people need to be scrubbed if you restore backups, and you delete old backups. The ICO has excellent guidance on this and other subjects: https://ico.org.uk/for-organisations/guide-to-data-protectio... > T…

The GDPR is extremely easy to comply with

It’s really just a slight mental shift. Instead of seeing data as an asset see it as a liability. Once you do that everything comes naturally.

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#99

Post by dspillett »

zorga wrote: post #55
bhaak wrote: post #45

Earlier quoted context omitted.

> [...] it seems to me that an unintended consequence is that non-technical people hosting forums/blogs etc. will be at risk of GDPR requests that they cannot comply with due to lack of technical skills [...] If it's only due to technical skills then this problem can be solved technically. The forum software needs to enable people to be GDPR compliant. > On a semi-related note: if you are a small SASS operator wantin…

And all of those demands are an unreasonable burden on businesses. Fuck the GDPR, they have no more authority over me than China or North Korea does.

If your business wants to collect my data without providing the safety measures GDPR provides, then fuck your business, I don't want to deal with it or you.

Of course if your business doesn't collect our data, there is no issue either way.

Re: An Eve Online corporation has been hit with a GDPR request from an ex-member

#100

Post by TheSpiceIsLife »

tokyodude wrote: post #56
ThePhysicist wrote: post #3

I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data of him/her left anyway. If there is data left just collect it, send it to the person and delete it afterwards (surely there’s a way to search posts by author in their forum software). I can understand that such requests are difficult to answer for companies th…

> ThePhysicist: I don’t understand where’s the difficulty in answering this request? If the person doesn’t have a user account anymore on the site there shouldn’t be much data of him/her left anyway. Deleting all posts in a forum by a certain user will not delete all posts in a forum by other users that quoted the user who desires to have their data deleted.

I'm not software expert by any means, but couldn't the deletion script also do a search for quoted text, at least sufficient to comply with the reasonable steps language of the legislation?
Post reply on HN