Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord fined €800k for failing to comply with several obligations of the GDPR

cnil.fr

Post reply on HN
Print view View original

231–240 of 306 posts

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#231

Post by dogleash »

namdnay wrote: post #205
nabla9 wrote: post #171

Earlier quoted context omitted.

No. Email is private messaging. If you send email to me and then delete it in your end, I'm allowed to store your email as a whole (sometimes legally obliged).

And if I send an email to 200 recipients they can all store it, I don’t see the fundamental difference for discord TBH

>email to 200 recipients they can all store it

On discord there are no 200 individual "they" storing it. It's stored by discord. (Or I guess people could be manually logging their own chats, but that's not the issue at hand here.)

At first pass it might sound like some minor technical squabble about implementation details, but there is intentionality in design decisions. The legal system can not be blind to those.

Discord chose a design that put them in control of the data. I'm not saying the highly centralized nature of their design is bad, wrong, or wasn't the best choice for the product they want to build. What I am saying is that when the legal system looks at the nature of a product, it has to look beyond what's presented in the pretty UI and marketing materials. It will look at the business' processes too.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#232

Post by ryandrake »

grumbel wrote: post #164
sschueller wrote: post #35

Earlier quoted context omitted.

Why do apps think it is necessary to start playing with the UI when we have a minimise button? When I click "X" I expect the application to exit as it did in Windows 1.0 and the minimise button to either put it in the startbar or the status bar but keep running. EDIT: I remembered incorrectly, Windows 1.0 did not have a X button but a close button on the right side of the window.

Minimize keeps cluttering up the taskbar. That's why all persistent-background apps go into the systray, be it chat apps, mouse drivers, graphics driver or whatever. You don't want them to fill up your taskbar for no reason. This has been common practice since the Windows95 days. Windows could handle this a bit better (e.g. different symbol than "X"), but there is nothing wrong with the behavior itself. A clear icon…

I think people are just arguing that this is a terrible practice. Instead of having a clogged up taskbar, you have a clogged up tray. In hindsight, Microsoft should have somehow added a better UI affordance back in the 90s, to disincentives this abuse.

Mac has its own share of applications going against the OS convention. There are quite a few third party Mac applications that annoyingly force the process to exit when the user closes the main window. There are Mac apps that are also starting to intercept ⌘Q and not exiting the process or, infuriatingly, making you hold the key down in order to actually exit (I'm looking at you, Chrome).

I wish product designers would please just stop thinking their app is uniquely special, second guessing OS conventions.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#233

Post by origin_path »

FamosoRandom wrote: post #60
origin_path wrote: post #26

Does Discord even have a corporate presence in the EU? For the French government to be fining companies because they happen to dislike the UI is such a random and unpredictable decision that it seems like a strong signal for US firms to not set up offices in the EU at all.

it's not so simple as "disliking the UI", it's about the UI/UX being clear enough that the user understand what he is doing in order to not be harmed by it in any way (disclosing personnal information for instance). Simply imagine that the user thought that, by clicking the "X" button, he closed the app and got off the vocal channel so that now nobody can hear him. Now a close relative ask him some other personnal in…

"not about disliking the UI but about protecting you, the user"

All you've done here is repeat their reasoning for why they dislike the UI.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#234

Post by crtasm »

lightedman wrote: post #223
crtasm wrote: post #212

Earlier quoted context omitted.

Minimising the window would achieve that, it's not necessary for closing it to also do so.

Closing the window frees up some video RAM, as you are no longer processing and displaying video streams from the voice/video chat. Minimizing the window keeps that RAM in active use.

Then that's also an issue that Discord should work on.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#235

Post by spiffytech »

sva_ wrote: post #74
wincy wrote: post #38

So if I’m an American company and have no offices in Europe and ignore GDPR for my free customers, what happens? Will I get arrested by the Polizei when I land in Berlin? Will the US force me to pay these fines?

Basically, if you do business in the EU (have customers there) then you'll be held accountable.

Or if you have non-paying users. Commerce is not a requirement for being subject to the GDPR.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#236

Post by smileybarry »

xnorswap wrote: post #21
tl wrote: post #3

> When a user logged into a voice room closes the DISCORD application window by clicking on the "X" icon at the top right of the window in Microsoft Windows, they actually just put the application in the background and stay logged into the voice room. However, in Microsoft Windows, clicking on the "X" at the top right of the last visible application window will exit the application for the vast majority of applicatio…

It's hard to blame apple or blame microsoft for simply having a different convention, which they've long had, I remember struggling to use an iMac back in the day because nothing ever quit when I wanted it to, but I accept that their model is different. In Windows it's convention for the top right X to be "Quit Application" and equivalent to alt+f4. It can be useful to have X close to system tray, in which case they…

> In Windows it's convention for the top right X to be "Quit Application" and equivalent to alt+f4.

Depends on the app. Some apps, specifically communication, have a convention of: "_" minimizes to taskbar, "X" minimizes to tray. The latter is used constantly because I don't want Discord sitting in my taskbar half the day, but I want to stay online (and sometimes in a voice chat with friends).

On that note, I find this point completely ridiculous given that: (A) Discord notifies you the first time you "X" it that it minimized, and (B) IM apps dating back to MSN Messenger in 2003 would do this.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#237

Post by debugnik »

FamosoRandom wrote: post #193
debugnik wrote: post #174

Earlier quoted context omitted.

> Simply imagine that the user thought that, by clicking the "X" button, he closed the app Do most users think that, though? I remember chat apps minimising to the tray bar since MSN Messenger and Skype, possibly earlier, and it's a common feature in most current ones, as well as in other applications. Now, it's true that some other chat apps display a floating panel to remind you that you're still in voice chat, but…

Look at your web browser. If you click on the "x" on a open tab, it will most likely close it. If you click on the "x" on your browser, it will close the browser, maybe will it alert you that you're going to close many things. Open Microsoft Excel or Microsoft Word, Notepad, your Windows file explorer, same thing. Those are probably the most used app in the world, so people will assume that it is what the "x" button…

None of those are supposed to stay on the background (specially not browsers, which are sandboxes for untrusted apps nowadays).

But if I click X on my email client, it keeps receiving email; if I click X on my torrent app or JDownloader, they keep downloading; if I click X on Steam, it keeps updating my games; and if I click X on a chat application, it keeps receiving messages and, yes, usually keeps voice chat open.

And BTW, browser tabs sadly do stay open in a twisted way: notifications, often malicious for the kind of users that accept the prompts without reading.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#238

Post by cesarb »

akuji1993 wrote: post #143
bjt2n3904 wrote: post #133

Some questions I need answered, that have yet to be answered in the article, or the comments here: Does Discord have an officially established business presence in the EU? That is, do they have an office? Employees? Remote workers officially living in the EU? A business license of some sort? One of the large questions here, entirely separate from the validity of the technical issues is of jurisdiction, and the answer…

You don't have to have a presence established in the EU to be under EU jurisdiction. Any european user makes you responsible to ensure GDPR rules for that user. So even if Discord had no presence in the entire EU, no office, no worker, no nothing, it doesn't absolve the company from staying within GDPR rules for their european users. Only way to get out of that problem is to block any user with a european IP, althoug…

> You don't have to have a presence established in the EU to be under EU jurisdiction. Any european user makes you responsible to ensure GDPR rules for that user.

That argument has always seemed recursive to me. The law that says "having an EU user means you are under EU jurisdiction" is an EU law, so for it to apply to you, you have to be under EU jurisdiction. What's the base case?

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#239

Post by xphx »

nells wrote: post #206
baxtr wrote: post #151

Earlier quoted context omitted.

In any case, 800k is a ridiculous amount for such a huge company like Discord.

They’ve probably never made any money.

"in August 2021, Discord had reported $130 million in 2020 revenues, triple from the prior year, and had an estimated valuation of $15 billion"

https://en.wikipedia.org/wiki/Discord#History

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#240

Post by osener »

I wonder how this is supposed to work with workplace apps such as Slack.

Assume I am leaving my job and want my personal information removed from this third-party service (Slack). They say [1] "Primary Owners of a workspace or org must contact Slack to request deletion of a deactivated member's profile information.". What if I contact the "Primary Owner" before leaving my job and they ignore my request, or if I've already left and don't know how to contact them or who they are? Why can't I simply request that my personal information be removed from a completely third-party American company's database?

I thought about this out loud before, and got the response "If you are using company account, company owns the data. The data produced during company time is company's property. Company has to request for deletion. Slack is right about it."

That made makes me ask more questions:

- Is my full name, birth date, telephone number, job and other details Slack collects company property?

- Can they also sell this to other third parties, along with my social security number, which the company also collected during business hours?

- Is Slack also free to sell this data to third parties?

- Does GDPR protect your personal information ONLY if you gave it away during your free / unemployed time using your personally owned devices and ONLY to services you have admin access to?

[1] https://slack.com/help/articles/360000360443-Delete-profile-...

Post reply on HN