Hacker News Reader

Comment by adrianmsmith | Hacker News Reader

Does anyone know why Microsoft believe that GDPR disallows comments? Or why GDPR does actually disallow comments in case that's the case?

View on HN

Couple of responses to that question here: https://devblogs.microsoft.com/oldnewthing/20190313-01/?p=10...

Basically the old accounts couldn't be carried over and so users wouldn't be able to log in anymore to delete their comments.

Or more accurately, MS did not want to make the effort to carry it over.

GDPR made it more expensive to port the comments, because it insisted that the user have control over their content. It did not prevent it from being done.

Control doesn’t mean that you need a user interface or an account management. It merely means that MS needs to respond to a request like "I posted this comment, please delete it". Furthermore, under GDPR you don’t have to delete everything a user has written. Only personal information. Although it’s probably easier to just delete the whole comment.

If you don't have a system in place to automatically cleanse user-submitted content, you have a liability. The chilling effect this has will only grow over time.

I'm not sure what law that's included in, but it's not part of GDPR.

Might be the copyright reform, but comments should still be fine with that.

Not sure why this is being downvoted. "If you don't have a system in place to automatically cleanse user-submitted content, you have a liability" is indeed not part of GDPR as far as I know, nor does it seem to be the reason why the comments weren't migrated.

Probably referring to "right of erasure"? If you want to delete your comments, but there is no mechanism for that, then Microsoft may be in violation of that part of GDPR.

Yep, I said as much in another comment. The downvoted comment I replied to was still right -- the issue preventing MS from migrating comments doesn't appear to be liability due to a lack of filters, which isn't even part of GDPR.

See: https://news.ycombinator.com/item?id=19457322

It could be that I'm confusing it with something else, it's hard when everything is named with meaningless acronyms. But I really thought it was something to do with GDPR even if the connection isn't immediately obvious.

You are thinking of Article 13 (the upload filter), which hasn't been passed yet. Not to be a pendant, but an initialism cannot be meaningless almost by definition -- it has to mean something otherwise it wouldn't be an initialism. GDPR means the "General Data Privacy Regulation".

FWIW, I completely agree with you on the chilling effect of upload filters. But upload filters aren't part of GDPR by any stretch of the imagination.

If I write a comment and my name is bryanrasmussen and then later I want to delete any data that can be publicly linked to me then I suppose a comment written with my name on it might count.

It also might not.

It might be worth it to some company to determine which it is, but who would expect that company to be Microsoft?

The GDPR doesn't say anything about requiring automated systems do do any of this. The volume of erasure requests is so low that I doubt it would even be worth it for Microsoft to invest in such a system.

MSDN comments still exist and Microsoft operates several forums. Perhaps GDPR is a questionable excuse for some lazy sysadmin not wanting to migrate comments, but it doesn't fly here.

What about HN? Their response to deleting comments is halfway between the thumb and the pinky.

Yikes, that's false and not nice. We delete comments for people nearly every day. It's true that we don't allow wholesale deletion of account histories, because that would gut the threads the account had participated in. But we also don't want anyone to get in trouble from anything they posted to HN.

The idea is to balance the need to preserve history (community interest) and the need to protect users (individual interest). We don't get there perfectly, but I can tell you for sure that the vast majority of people who ask us about this end up happy with how we help them.

My understanding of the policy matches the parent comment from communications I've had. Is this a recent policy change?

It's not the case. But organizations as big as Microsoft are often paralyzed by lawyers.

Their own lawyers, but also the ones that are itching for a big juicy target to sue.

I vividly remember the meeting I went to in 2003 with a bunch of Microsoft bloggers and lawyers -- it was one of the few times Raymond Chen and I were in the same room. :-)

It was astonishing because of what the lawyers said: yes, it is a public relations risk to have ordinary employees communicating directly with the developer community, and we are willing to take on that risk if it dramatically improves our satisfaction metrics in the developer community.

We were basically told "don't be stupid, don't share corporate secrets, comport yourselves professionally, keep it on-topic, and if there are legal problems, legal will handle them appropriately".

I don't know that things would be the same today; it was a different time. But I'd hope so.

That's pretty great :) I mean, of course there are situations where legal is right and there are situations where a risk is taken because it's worth it, like in that situation. The newegg anti-patent-troll stance comes to mind as well. But being overly risk averse and having lawyers drive the company happens as well, and it might have happened with the comments here.

That's pretty cool. Imo, I think it really paid off and I'm thankful to get the kind of insight into Microsoft that these bloggers managed to give. I think it humanized Microsoft and their developers for a lot of people (including me).

The problem is the EU approach to GDPR enforcement. Fines are so huge that probably MS lawyer team decided not to take chances for something that does not bring revenue - some developers might cry on Twitter or Facebook for a week or two, but that would cost MS nothing.

Unfortunately "right to be forgotten" has been wrongly defined in GDPR, if someone published something in a publicly available place, this shouldn't be removable on demand. I am perfectly for forcing companies to be obliged to delete its customers data if customer does not want make business with a said company or does not want to allow company to use the data for its business (like advertising), but this should not cover every random forum in the Internet.

In fact this is the reason those independent forum will disappear soon or later and be moved to Facebook, which is rather sad and shows only how EU bureaucracy is inefficient - they wanted to restrict Facebook usage of private data, instead they only caused even more people to move to Facebook and give up their privacy.

Reply on news.ycombinator.com