Hacker News Reader

Comment by tcd | Hacker News Reader

I can imagine it's easier and safer (from a legal perspective) to just delete the data and therefore no longer be responsible for the content. Twitter wants to delete older Twitter accounts because they're required to by law under the GDPR.

I mean, the GDPR makes things kind of difficult in this regard, and I suspect even archives are liable if somebody takes an issue with content they are hosting.

View on HN

This seems relatively cheap to fix. Spin off Yahoo Groups as a new corporation, and have that corporation subsequently donate all its assets. If the corporation somehow manages to get sued, it doesn't really matter, since it has no assets.

Or spin it off and sell it.

No non-privately owned company would ever willingly put itself through the legal and tax requirements for spinning off a new company with part of its assets just to do the right, non-profitable thing, with those assets.

Also, in my opinion, no privately owned company either, unless the owner was soon dying of something and wanted to get in good with their creator.

I’d assume the law is smarter than this, because companies would otherwise continually spin of new corporations to get rid of their liabilities with no assets as a sort of lightning rod for lawsuits.

This is, iiuc, how the movie and construction industries work. Spin up a minicorp for every big risky project to shield the mother ship.

When you create the SPV in advance, it's very clear what part of the work done by the organization attaches to it (because the organization ensures that all its processes explicitly specify the legal compartment they're running under.)

When you create an SPV after-the-fact, you have to go back and reverse-engineer a separation of liabilities from documents that don't specify whether they're work done for the organization or the SPV (because the SPV didn't exist.)

It's like a divorce. (Or, for an even more on-the-nose analogy, it's like trying to use a condom after-the-fact by extracting any bodily contamination and putting it in the condom.)

They do it regularly. Lead in gasoline (ethyl corp), asbestos.

If Yahoo Groups has a GDPR obligation now (and it's not clear that they do) they don't erase obligation that by spinning up a different company and dumping all this personal data into that new company - that would be its own GDPR breach.

That doesn’t sound correct, given they GDPR doesn’t generally apply to archival products.

Why not? According to GDPR someone can show up and request (1) fixing personal data (PII) like nickname - this is data accuracy requirement, in fact, according to GDPR Yahoo should do the data accuracy check (for instance send a reminder to the user to check data). (2) Someone can file data portability request, Yahoo needs to provide this. (3) Some can request data removal. (4) Yahoo has to managed user consents for anything they do with those data.

For a product that does not bring any revenue or significant revenue, it is better to dump everything and simply don't be associated with data any longer.

That's the side effect of GDPR, it is hard from the technical and financial perspective to maintain anything free on the Internet that keeps user's data.

GDPR has an actual archive exception to the "right to be forgotten", art. 17, §3d [0]. IANAL, so I don't want to say if it covers this archival, but I would hope so.

0: https://gdpr-info.eu/art-17-gdpr/

Anything being archived by archive.org is pretty clearly being done in the public interest. If it was something like Equifax archiving the data to use as a factor in people's credit scores then it would be much more ambiguous.

> Twitter wants to delete older Twitter accounts because they're required to by law under the GDPR.

So, by analogy, if Twitter did allow people to download an archive of any public Twitter account's history... what would the GDPR require them to do? Wrap those archives in some sort of auto-expiring DRM?

Reply on news.ycombinator.com