41–50 of 99 posts
There seems to be a legal theory that public discourse is not to be removed under the GDPR. Discord, for example, will also not delete your messages. Part of the problem is also that the government agencies tasked with regulating these things are hopelessly slow in pursing matters, especially when non-EU companies are concerned.
If HN stores IP addresses or does any sort of de-anonymization on their end, then probably yes. They cover this in their privacy policy, at least for California [1], but their terms of use (right to refuse deletion) seem inconsistent with CCPA. Also, if they don't store IP or actively deident, then I'm not sure either reg applies. HN isn't collecting PII. Just because you chose to type some info into a free form text…
.
> ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
(Article 4)
If HN stores IP addresses or does any sort of de-anonymization on their end, then probably yes. They cover this in their privacy policy, at least for California [1], but their terms of use (right to refuse deletion) seem inconsistent with CCPA. Also, if they don't store IP or actively deident, then I'm not sure either reg applies. HN isn't collecting PII. Just because you chose to type some info into a free form text…
.
I've definitely never received this advice. I think your DPO/counsel are being excessively risk-averse, but IANA(EU)L.
If HN stores IP addresses or does any sort of de-anonymization on their end, then probably yes. They cover this in their privacy policy, at least for California [1], but their terms of use (right to refuse deletion) seem inconsistent with CCPA. Also, if they don't store IP or actively deident, then I'm not sure either reg applies. HN isn't collecting PII. Just because you chose to type some info into a free form text…
.
This isn't American law, where everything seems to be decided based on technicalities and the exact wording of the law. These decisions are made by reasonable human beings who review the facts of the situation and come to a judgement.
HN is a respite from those awful cookie banners, that's something.
Dark pattern banners I call them. One day I clicked the 'more options' button on a foreign website and it was a list of over 1000 different third parties listed each with their own toggle.
I can’t wait for the day the EU actually tries to enforce their laws on individuals and companies with no presence there. Will be a fun extradition battle to watch
No EU country would ever try to extradite anyone over a GDPR violation... International companies that choose to process data from EU citizens but blatantly ignore the regulation will be subject to enforcement action from the country's supervisory authority. The supervisory authority has the power to "order the suspension of data flows to a recipient in a third country or to an international organisation" or "to impo…
Now you know how we feel when Europeans pontificate about issues in the US without really knowing anything beyond the headline.
Also, FWIW a lot of HN participants are in California, which has CCPA. Your stats may well be objectively wrong anyway.
If HN stores IP addresses or does any sort of de-anonymization on their end, then probably yes. They cover this in their privacy policy, at least for California [1], but their terms of use (right to refuse deletion) seem inconsistent with CCPA. Also, if they don't store IP or actively deident, then I'm not sure either reg applies. HN isn't collecting PII. Just because you chose to type some info into a free form text…
I'd guess HN isn't big enough for basically any privacy law to apply. Some parts of GDPR at least call out company size explicitly, other parts allow for "cost of implementation" to be considered, which for HN would probably be "prohibitively high" regardless of triviality, considering the team size.
Seems like a risky gambit; AFAIK YC owns HN and would have a hard time arguing that that they're a small business incapable of following GDPR regs.
But honestly YC probably doesn't even think about any of this, for good or bad. Most companies are super duper behind the ball on privacy regulations, despite the negative consequences.
CCPA states: The right to know the personal information that businesses have collected from an individual The right to opt-out of the sale of consumer data collection The right to delete personal information collected from them HackerNews doesn't collect personal data. Deleting anything someone wants deleted isn't covered
Pretty sure it requires deleting comments if requested, this at least how my employer treats GDPr.
CCPA states: The right to know the personal information that businesses have collected from an individual The right to opt-out of the sale of consumer data collection The right to delete personal information collected from them HackerNews doesn't collect personal data. Deleting anything someone wants deleted isn't covered
There's an email field in the settings.