This step removes all the trust in Instapaper that I had in the past: They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU.
I don't know a ton about GDPR, but the article makes it look like it has less to do with Instapaper (aside from risk tolerance) and more to do with the ambiguity of the law. Some relevant quotes:
> it’s more than likely to be the GDPR’s data subject access request, which allows any EU resident to request any and all data collected and stored about them. As The Verge reported yesterday, that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases.
> It’s clear that few companies, if any, will be 100 percent compliant when the law goes into effect. But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. So that’s why companies are rushing and, in the case of Instapaper, literally shutting down.
If they ask for something specific in an informal way, that can be provided
But from the GDPRs data portability point of view, it's everything that's linked to the account. Export your Facebook data for a good example of this.
HN example: it would be the information in your profile, the links/text you submitted (but not the content of the link itself), the comments (the comment IDs) you upvoted, stories flagged/upvoted (for the lenght of time this is kept, for example, if after a while user ids that upvoted a comment are erased and only the score is kept, that's fine) and maybe some other background information (for example: password hashes/access logs/etc)
> what format that information needs to be in,
Machine readable format. HTML/XML/JSON is fine.
> how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline.
Well that's not the problem of the law, is it?
You know your data scheme. You know whether you can run this in your existing infrastructure or not.
for TABLE in YOUR_TABLES
SELECT * from TABLE where UserID == $user_id;
end for> Can I request all of this information be deleted?
Yes, the ones that are on HN. I'm not sure how it works for 3rd parties that obtain your data
> does this include other comments that referenced my username?
I don't think so, this is unlikely, especially as you didn't create it and HN doesn't link this (as opposed to reddit)
> What about comments that might have linked to my GitHub profile?
I'd say that being required is even less likely as HN has no way of knowing what's your GH profile
GDPR is what they know about you. If they're actively trying to link pasted GH profiles and usernames then this would apply, otherwise no.
> What if there are server logs that include my IP and a time which can correlate to when I posted a comment or something?
That thing with IPs being PII I'd say this would apply, but then again, this doesn't bring any new information.
So if they keep track of users access times then yes, but if this information is rotated, sent to /dev/null then no.
You're not obligated to connect all the dots, or track user login times. That being said, IP (especially + times) are PII so better anonymize it and discard once not needed.
Arguably much or all of the entries with FKs to those rows as well, transitively. Unless you don't believe in normalisation :)
(I'll leave the normalization debate for later :) )
The violations won't be fined with 4%/€20m (€ not $) right away, there's more steps before that, starting with "a warning in writing in cases of first and non-intentional noncompliance"
Maybe some companies have overreacted, but dismissing them feels a bit like blaming the user for bad UX.
Couldn't you argue that a law that causes a panicked overreaction was a poorly written law in at least one respect, given that laws have a communicative function?
Especially if all these complaints were raised well in advance of the passage of the law, so that the drafters had plenty of warning that several groups were struggling to understand the text?
The german Wikipedia has a lot more details on the history and development of the regulation: https://de.wikipedia.org/wiki/Datenschutz-Grundverordnung
It's a site that pins articles people have saved, the only piece of user data they should hold would be email address and maybe IP address? Simple to put in policies to expire the IP address data after a reasonable amount of time.
So there's something you're not telling.
Will? The usual misinformation then.
You forgot "up to, depending of severity of violation".
Isn't there a lower level - 2% and $10 million too?
Not quite. LITERALLY years. Two of them. A bit more if they were keeping an eye on the matter while the regulation was being drafted (though I doubt very many were, I know I wasn't).