HN Violates the GDPR

#1

Post by feld » Thu, May 30, 2019, 3:16 PM UTC

There is no way to delete your account and your comments on HN. This is a violation of the GDPR. Why has this not been addressed yet?

https://gdpr-info.eu/art-17-gdpr/

Re: HN Violates the GDPR

#2

Post by hombre_fatal » Thu, May 30, 2019, 3:22 PM UTC

Why would HN care about some EU directive? They also don't have that obnoxious cookie warning.

Re: HN Violates the GDPR

#3

Post by mtmail » Thu, May 30, 2019, 3:24 PM UTC

Last year's discussion "Ask HN: Does HN respect the GDPR?" https://news.ycombinator.com/item?id=16661323

Re: HN Violates the GDPR

#4

Post by DanBC » Thu, May 30, 2019, 3:30 PM UTC

Citizens don't have an absolute right to have all data erased on request.

The comments are still needed and being used for the purpose they were gathered for, so this fails the first point in your link

> the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

If there is identifying data in the comment you can email the mods and they will (I think) redact it for you.

Most usernames do not identify a natural person, so that means most accounts fall outside GDPR. If they do identify a natural person I think you could email the mods and they'd change the name. (Obviously I have nothing to do with HN so I can't tell you what they will or won't do).

tl;dr most accounts aren't covered by GDPR and the mods will do stuff with the ones that are.

Re: HN Violates the GDPR

#5

Post by yulaow » Thu, May 30, 2019, 3:45 PM UTC

hombre_fatal wrote: post #2

Why would HN care about some EU directive? They also don't have that obnoxious cookie warning.

I think they don't have a cookie warning because they don't use profiling cookies but just the technical ones.

Re: HN Violates the GDPR

#6

Post by ars » Thu, May 30, 2019, 3:57 PM UTC

Are you saying you want EU users blocked from HN? Lots of sites have done that, but I think EU users find the blocks annoying.

Re: HN Violates the GDPR

#7

Post by LinuxBender » Thu, May 30, 2019, 4:00 PM UTC

DanBC wrote: post #4

Citizens don't have an absolute right to have all data erased on request. The comments are still needed and being used for the purpose they were gathered for, so this fails the first point in your link > the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; If there is identifying data in the comment you can email the mods and they will (I think) r…

Renaming gets interesting too. The person requesting the rename would have to also chase down all the off-shoots of HN that cache and re-display all the messages in different formats. And then there is archive.org that would have copies of all sites in question. Archive.org isn't going to rename anything.

Re: HN Violates the GDPR

#8

Post by trothamel » Thu, May 30, 2019, 4:03 PM UTC

I'm sure we could find a North Korean law HN doesn't comply with, if we looked hard enough.

Re: HN Violates the GDPR

#9

Post by yummybear » Thu, May 30, 2019, 4:10 PM UTC

DanBC wrote: post #4

Citizens don't have an absolute right to have all data erased on request. The comments are still needed and being used for the purpose they were gathered for, so this fails the first point in your link > the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; If there is identifying data in the comment you can email the mods and they will (I think) r…

I don't believe this is compliant with the GDPR. Afaik usernames are considered personal data, as are user ids. Both are a form of online identifiers:

"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."

Re: HN Violates the GDPR

#10

Post by Dayshine » Thu, May 30, 2019, 4:15 PM UTC

Why do you think Article 17 applies to Hacker News?

I don't mean the GDPR, I mean having read the article, which of the grounds do you believe applies?

The only one that's plausible is 1.b), and I'm not convinced that Hacker News is storing your data using Article 6 1(a).

The Right to Erasure applies to some pretty specific situations, mainly where the data is being held using consent only. I'm fairly sure that Hacker News stores your user content either under "Legitimate interest" or "Contract".