*.ycombinator.com Terms of Use

Though certainly there is a 'pattern' to these that I think lawyers just fall back into that can be less understandable than needed.

If nothing else, many contracts are written in a somewhat weird frame, where one party is referred to in third person, and the other in second person. And often phrasing is so that the second person needs to recognize a claim of the third person ("you acknowledge etc etc").

In many ways, contracts are like the ultimate reversal of YAGNI. Imagine deploying code that you literally could not fix after release, and you knew that nearly all deviations from intended behavior would just kick you in the butt. Your code (and general product function) would probably get a bit weird too.

1. Legal contracts are supposed to be as detailed as possible so there's as little room for disagreement as possible when taken to court.

2. It's better for companies if users don't take the time to read and understand their terms, and beyond a certain length and complexity they will just scroll through and click yes.

1. Processing that takes place in the context of processors and controllers that are in the Union, regardless of whether or not the processing itself takes place in the Union.

2. Processing the data of subjects who are in the Union by controllers or processors who are not in the Union if the processing is related to offering goods or services to such subjects in the Union or the processing is related to monitoring the behavior of such subjects that takes place in the Union.

3. Processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

If none of those cover an entity, that entity's processing is not covered by GDPR.

#2 would probably be the only relevant one for HN.

Is HN offering goods or services to subjects in the Union? Sure, people in the Union can access HN and even make accounts. But that might not be enough. One of the recitals for Article 3 elaborates:

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Does HN envisage offering services in the Union, or is it simply a site that happens to work when accessed from the Union but was not envisaged to do so?

Another recital elaborates on the monitoring of behavior of subjects in the Union:

> In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

HN seems to collect minimal data. It might not rise to the level of monitoring that would be needed to count as monitoring behaviour.