Hacker News Reader

Comment by defertoreptar | Hacker News Reader

As someone who ran a forum centered around one of my passions, I was happy to help users out with small adminstrative tasks. Like you said, no big deal.

Now if I was legally required to act on every request in 30 days or face potential litigation, that's a totally different story. I'm doing something that's a fun hobby of mine for free that will benefit others with similar interests. The line is drawn when it can have real world consequences and take up a substantial amount of personal time in order to comply with frivolous requests. That's when it stops being fun and definitely not worth risking legal headaches.

View on HN

> act on every request in 30 days or face potential litigation

That's not what happens though. You get a request, you have 30 days to respond to it (and for the vast majority the privacy policy is ok as a response) and if the requester isn't happy they report it to the regulator who writes for more information. In that situation you again send off your privacy policy, maybe with a bit more detail.

The regulator either tells you that you're wrong, and explains why, and gives you advice to come back into compliance, or agrees with you and tells the requestor that they've misunderstood the law.

And all of this has provisions for proportionality. The regulators will recognise that small forums run for small projects will not have resources to respond to many requests.

If its a hobby and you otherwise have a full time job, 30 days is even too short. Not to mention that's when it stops becoming fun as the person mentioned.

This misrepresentation of the situation is well addressed in the other reply, but I'd like to point out that unless your hobby is collecting and processing personal data, you simply have to not collect any personal data as no personal data is required to run a forum, add a page explaining so and direct requests to this page.

What constitutes personal data hasn't been made clear. People think IP addresses and usernames will count, and really anything in someone's posts might too. Post timestamps are no doubt correlated with users timezones, that sounds like personal data to me too.

You could credibly argue that the sole purpose of a forum is to collect and share personal data.

Reply on news.ycombinator.com