Live data from Hacker News

Discord fined €800k for failing to comply with several obligations of the GDPR

cnil.fr

261–270 of 306 posts

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#261
post #239

Earlier quoted context omitted.

"in August 2021, Discord had reported $130 million in 2020 revenues, triple from the prior year, and had an estimated valuation of $15 billion" https://en.wikipedia.org/wiki/Discord#History

Revenue is not profit. You need to subtract expenses and whatnot.

That’s right. But for GDPR no one cares about profits. They need to be fined on revenue.

Otherwise non-profit making companies could do any privacy BS and not be fined.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#262
post #256

Earlier quoted context omitted.

GDPR is extra-territorial and its rights apply to EU citizens wherever they are in the world if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR (in theory)

No. GDPR isn't tied to citizenship. EU citizens & residents are not covered by GDPR when they are outside of EU unless member state's law applies by virtue of public international law ( https://gdpr-info.eu/art-3-gdpr/ ). A bit more unclear situation is if non-resident is visiting EU and uses services from their home country.

like most EU law it's badly written, but it states "to such data subjects in the Union"

given "within the Union" is used separately in the next sub-article to mean physically located within, it's arguable that "in the Union" could mean citizen of

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#263

Earlier quoted context omitted.

But that’s the same for gmail. If I send a mail to 200 gmail contacts, that mail doesn’t disappear when I delete my account

True. This is why I mentioned intentionality in design. The design of email means there is an argument for the legal system that gmail is a very very popular post office. That email is a system wherein users have disparate storage areas for receiving/archiving emails, and gmail is one of many organizations that offers users the service of managing their individualized storage area on their behalf. In the service that…

I would argue that discord and IRC, are email too. It's just the protocol of communication dictates. They all carry data to a username@somewhere; whether it a tld, username or id.

IRC enables Text & Attachments in text form (ie links)

Email Enables Attachments in visual (html emails)

Discord Enables Voice, Text and Attachments (Asynchronous sockets)

That's all it is. Present a Video, Picture, Voice to your visitor and you've got a new product. Just as facebook,twitter,myspace have been.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#264
post #240

I wonder how this is supposed to work with workplace apps such as Slack. Assume I am leaving my job and want my personal information removed from this third-party service (Slack). They say [1] "Primary Owners of a workspace or org must contact Slack to request deletion of a deactivated member's profile information.". What if I contact the "Primary Owner" before leaving my job and they ignore my request, or if I've al…

You could ask the local DPA to look at your former employer(and then sue them if they decide to ignore you). Companies have been fined for lax handling of employee data.

Slack is likely trying to operate under one of the attempts to replace the invalidated "privacy shield" framework(the current attempt is summarized here https://www.tadpf.eu/) for their European enterprise customers, and a part of this is having contracts prohibiting slack from handing out the data to any 3rd party, but your relationship here is with your former employer and not slack.

the Schrems rulings is a bit of a problem for slack here but that's not because slack is necessarily violating the GDPR directly but because the US does not live up to EU's standards for what a modern democracy is allowed to subject people to to in terms of protection against "unreasonable search and seizure"(this term actually comes form the Fourth Amendment of the us constitution but somehow the US courts don't think it applies to foreign persons or digital records held by cloud companies).

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#265
post #3

> When a user logged into a voice room closes the DISCORD application window by clicking on the "X" icon at the top right of the window in Microsoft Windows, they actually just put the application in the background and stay logged into the voice room. However, in Microsoft Windows, clicking on the "X" at the top right of the last visible application window will exit the application for the vast majority of applicatio…

On macOS, you can already close all windows without exiting an application, so Discord does not violate any established convention. (Clicking the red traffic-light close button does not usually close the entire app; Cmd+Q does.)

On Windows, there is no concept of applications at all, only windows. Perhaps you can try to mess with processes, but there's not even any mechanism for activation of a process that would even allow it to begin to work in any way similar to macOS's model.

So yes. Closing all windows, on Windows, is widely assumed to terminate the associated process. This is why apps like Thunderbird, for example, close entirely when you click the X, and only actually go to the system tray when you click minimize.

Interestingly, with Discord on Windows, Alt+F4 completely closes the entire app. The close button is implemented by the webpage, however, and closes to the system tray instead of actually closing the window.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#266
post #230

Earlier quoted context omitted.

>Interesting this is considered [Microsoft] Discord's fault and not Microsoft Windows. Probably because Discord implements the button, no? They configure what happens when you press "X", so their configuration is in violation, not the platform.

This whole thing is making my head ache. Pressing X or Alt-F4 sends WM_CLOSE to the window. By default this is converted to WM_DESTROY and closes the window. By default, an application with no more windows open will exit. It's quite normal for applications to intercept WM_CLOSE, for example with a modal dialog of "Do you want to save your files?". Over the past few years it has also become common for applications, in…

Discord's X button is implemented inside the webview and simply hides the window (to be revealed later by clicking the tray icon). It does not send WM_CLOSE or WM_DESTROY.

Alt+F4 is what actually closes the window, and in Discord's case, the entire rest of the app too.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#267

Earlier quoted context omitted.

How does this work for IRC networks?

IRC networks don’t generally store messages and your client only receives messages that are sent while connected to the network. Users can set up their own infrastructure to store messages received by their client, though, so you never know who might be collecting logs.

So I think you could get sued for hosting logs, or you must provide a way to delete data per request.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#268

Earlier quoted context omitted.

Except for Discord, which actually closes the entire application on Alt-F4 instead of just the window.

Huh. You are right. Alt+F4 closes the application, clicking the X closes the window. Kinda inconsistent.

Alt+F4 closes the window, clicking the X causes the window to hide, not close.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#269

Earlier quoted context omitted.

Huh. You are right. Alt+F4 closes the application, clicking the X closes the window. Kinda inconsistent.

Alt-F4 invokes different processes than the X button does. The X button is more akin to CTRL-F4.

Nah, they both send WM_CLOSE to the window. The actual problem is that Discord uses its own non-native window frame and reimplements the X button differently than they handle the actual close event.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#270

Seems insane, many apps keeps running with an icon visible in the notification area when exited like that. Discords icon also shows if you are in a voice channel.

It's not just that the application keeps running, but the active voice call you're in stays connected and everyone can still hear you. That is definitely counterintuitive, I would at least expect a popup saying "did you mean to close the call, this is just minimizing it to the background" or something. Also, that's 1 of 5 issues.

It's not counterintuitive to anyone who has used a VoIP application in the past ten years.
Post reply on HN