Hacker News Reader

Comment by Thiez | Hacker News Reader

I wonder which part of the GDPR they are using to demand sources. I have read the thing a couple of months ago and as I recall the thing is mostly about not sharing personal information without consent, does anyone else recall parts that grant governments new rights to demand the disclosure of personal information?

View on HN

Journalism is the practice of collecting information about people and disseminating it without their consent. Otherwise you’re just redistributing press releases.

This brings up an interesting question: if I tell people about you, am I doing something illegal?

What if I remember something about you?

You are probably joking, but the GDPR (and also the 'right to be forgotten') is not and has never been about the actual memories of a natural person. You diary (if you have one) is also not included in its scope.

You can remember whatever you want, about anyone or anything.

What part of the GDPR specifically addresses that?

No part of the GDPR specifically allows you to remember things, but Article 2 (which limits the scope of the law to data processed as part of a filing system) does except processing for purely personal activities in 2(2)(c).

https://gdpr-info.eu/art-2-gdpr/

Thanks! 2.2:

"This Regulation does not apply to the processing of personal data:

* "in the course of an activity which falls outside the scope of Union law;

* "by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;

* "by a natural person in the course of a purely personal or household activity;

* "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security."

So if you're a natural person working in a store you don't fall under this exception.

I thought the GDPR sign at the butcher shop was a joke?

I'm not sure exactly what GDPR means for the people whose job involves processing data, but I would think that independent of whatever rules apply to the employer as a data controller/processor, 2(2)(c) would except the employee's memory of what they did.

The part that says you have to be an entity (data controller or data processors) that matches a specific definition, not merely a person living their life.

Is a "data controller or data processor" well defined in the law? What in any way could somebody ever twist the wording to include a person living their life?

What if this person had a hobby of simply collecting and cataloging information bout people they come in contact with?

>What if this person had a hobby of simply collecting and cataloging information bout people they come in contact with?

Then they are a data controller.

"A data controller is the individual or the legal person who controls and is responsible for the keeping and use of personal information on computer or in structured manual files.

(...)

In essence, you are a data controller if you can answer YES to the following question: Do you keep or process any information about living people?"

https://www.dataprotection.ie/docs/Are-you-a-Data-Controller...

It depends what you tell them.

You can read an English translation of the demand letter here:

https://www.occrp.org/en/16-other/other-articles/8876-englis...

Thanks for that. Some of those points are actually reasonable, and a journalist should be comfortably within rights to respond that sources need to be kept secret, and comment why/how/why not subjects were alerted to the publication (perhaps given a chance to comment).

Hopefully this'll go to court and set a precedent that more in line with the spirit of the gdpr.

I am not quite certain how much a precedent matters here.

Of the western world we have the US, UK, and Canada that employ common law where precedent really matters.

In most of the EU the system of civil law is used, where the judiciary is expected to be much more literal and to not perform much interpretation or reference to previous interpretations.

Civil law has a concept similar to the common law world's respect for prior judicial rulings, but weaker. It's called jurisprudence constante (a French phrase). The impact of a single ruling on future rulings is not huge, but a series of rulings all in accord will be treated as strongly persuasive.

It's still secondary to the statute and not 100% binding, but nevertheless it is a real part of the system.

Also, both the US and Canada have a civil law jurisdiction: Louisiana and Quebec, respectively.

Both do make some use of common law as well, but private law (governing relations between non-state parties) is even now predominantly civil law in both places.

If the original actors in this case were non-state parties, I expect that civil law would be applicable to a hypothetical Quebec version of this dispute. In Louisiana, same thing if the relevant law was at the state level rather than federal. (In Quebec, even federal laws are interpreted using civil law principles when covering private law topics.)

Aaaand then we have the Scandinavian systems which are somehow both.

This confuses me as well. When a company has information about a natural person and that person was not the source of the information that person has a right to request the source and the company must disclose it. As far as I know that request/disclosure does not extend to the member state enforcement agencies.

In this case, the person (a politician) did request it -- and the enforcement agencies (headed by pals of said politician) try to make sure they'll get it.

Reply on news.ycombinator.com