Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#1

Post by ndmrs » Sun, Jan 30, 2022, 4:47 PM UTC

There are many headlines of people getting their accounts banned and losing access to a lot of important documents or services. Often, trying to talk to support on any of these companies is akin to talking to a wall.

However, GDPR has a clause stating that "The data subject shall have the right not to be subject to a decision based solely on automated processing". Which would mean that any EU/EEA citizen should have the right to have the decision reviewed by a human.

Has anyone successfully overturned a banned account using this method?

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#2

Post by lambada » Sun, Jan 30, 2022, 6:06 PM UTC

From memory I believe FAANG etc all _claim_ that appeals you lodge are reviewed by a human.

Now if you don’t believe them then you’d need to take them to court and show why you think that’s not the case.

Which I guess means my question is why don’t you believe them and how likely is it that they are lying when they claim thy appeals are reviewed by a human?

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#3

Post by tyingq » Sun, Jan 30, 2022, 6:10 PM UTC

lambada wrote: post #2

From memory I believe FAANG etc all _claim_ that appeals you lodge are reviewed by a human. Now if you don’t believe them then you’d need to take them to court and show why you think that’s not the case. Which I guess means my question is why don’t you believe them and how likely is it that they are lying when they claim thy appeals are reviewed by a human?

There was a recent example with Google Drive where it explicitly disabled any way to appeal. I was able to reproduce the issue where it was flagging files that consisted of a single byte, sometimes followed by \r\n or \n.

Here's the HN story: https://news.ycombinator.com/item?id=30060405

Screenshots of trying to "appeal" (Request a review) from when I recreated the issue show pretty clearly there is no human involved: https://imgur.com/a/5YHQtLi

This wasn't an account ban, so I don't know how well it fits the GDPR language. Though I'd be surprised if this was somehow the only "fully automated account action" FAANG type companies are doing.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#4

Post by ilamont » Sun, Jan 30, 2022, 6:31 PM UTC

The data subject shall have the right not to be subject to a decision based solely on automated processing

Lots of leeway for FAANG/BigCo management to wriggle out of that one. "Sure, Jones in Legal gets an email notification every time an account is banned and has the option to review it."

I can only imagine the lobbying and "negotiation" that takes place to have legislators water down the requirement for real human beings to review or respond to such bans.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#5

Post by toomuchtodo » Sun, Jan 30, 2022, 6:31 PM UTC

lambada wrote: post #2

From memory I believe FAANG etc all _claim_ that appeals you lodge are reviewed by a human. Now if you don’t believe them then you’d need to take them to court and show why you think that’s not the case. Which I guess means my question is why don’t you believe them and how likely is it that they are lying when they claim thy appeals are reviewed by a human?

> Which I guess means my question is why don’t you believe them and how likely is it that they are lying when they claim thy appeals are reviewed by a human?

Why would we believe them? It's Google's responsibility to prove their assertion, versus regulators taking them for their (not so good) word. The default should be the assumption that the corporation is being dishonest.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#6

Post by delroth » Sun, Jan 30, 2022, 6:40 PM UTC

Not speaking for my employer, but the actual quote from GDPR is:

> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Emphasis mine. This would not include the vast majority of automated bans. It's more meant as a way to prevent e.g. automated police action via algorithmic selection.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#7

Post by jeffbee » Sun, Jan 30, 2022, 6:43 PM UTC

tyingq wrote: post #3

lambada wrote: post #2

From memory I believe FAANG etc all _claim_ that appeals you lodge are reviewed by a human. Now if you don’t believe them then you’d need to take them to court and show why you think that’s not the case. Which I guess means my question is why don’t you believe them and how likely is it that they are lying when they claim thy appeals are reviewed by a human?

There was a recent example with Google Drive where it explicitly disabled any way to appeal. I was able to reproduce the issue where it was flagging files that consisted of a single byte, sometimes followed by \r\n or \n. Here's the HN story: https://news.ycombinator.com/item?id=30060405 Screenshots of trying to "appeal" (Request a review) from when I recreated the issue show pretty clearly there is no human involved…

Are you suggesting that Europe has established a fundamental human right to have Google provide free static hosting services?

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#8

Post by Someone » Sun, Jan 30, 2022, 6:44 PM UTC

tyingq wrote: post #3

lambada wrote: post #2

From memory I believe FAANG etc all _claim_ that appeals you lodge are reviewed by a human. Now if you don’t believe them then you’d need to take them to court and show why you think that’s not the case. Which I guess means my question is why don’t you believe them and how likely is it that they are lying when they claim thy appeals are reviewed by a human?

There was a recent example with Google Drive where it explicitly disabled any way to appeal. I was able to reproduce the issue where it was flagging files that consisted of a single byte, sometimes followed by \r\n or \n. Here's the HN story: https://news.ycombinator.com/item?id=30060405 Screenshots of trying to "appeal" (Request a review) from when I recreated the issue show pretty clearly there is no human involved…

I don’t see how you get from Google’s statement “Was taken down for legal reasons and cannot be appealed“ to “no human was involved”.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#9

Post by foxfluff » Sun, Jan 30, 2022, 6:46 PM UTC

jeffbee wrote: post #7

tyingq wrote: post #3

Earlier quoted context omitted.

There was a recent example with Google Drive where it explicitly disabled any way to appeal. I was able to reproduce the issue where it was flagging files that consisted of a single byte, sometimes followed by \r\n or \n. Here's the HN story: https://news.ycombinator.com/item?id=30060405 Screenshots of trying to "appeal" (Request a review) from when I recreated the issue show pretty clearly there is no human involved…

Are you suggesting that Europe has established a fundamental human right to have Google provide free static hosting services?

I think reading the part where they say "I don't know how well it fits the GDPR language" would answer your question.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#10

Post by tgsovlerkhgsel » Sun, Jan 30, 2022, 6:50 PM UTC

jeffbee wrote: post #7

tyingq wrote: post #3

Earlier quoted context omitted.

There was a recent example with Google Drive where it explicitly disabled any way to appeal. I was able to reproduce the issue where it was flagging files that consisted of a single byte, sometimes followed by \r\n or \n. Here's the HN story: https://news.ycombinator.com/item?id=30060405 Screenshots of trying to "appeal" (Request a review) from when I recreated the issue show pretty clearly there is no human involved…

Are you suggesting that Europe has established a fundamental human right to have Google provide free static hosting services?

The EU has established that "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." (https://gdpr-info.eu/art-22-gdpr/)