Hacker News Reader

Comment by godzillafarts | Hacker News Reader

My org received one of these emails. I was the engineer pinged on the support ticket.

This request is neither threatening nor burdensome. This is a pretty standard run-of-the-mill GDPR request. We get them all the time.

It took less than 60 seconds of my time to provide our support team with the information they needed to respond to the request. In fact, we already have a canned response to these requests - the person on the support team is a new hire and was unaware.

If your org has users/customers in the EU, you need to have a GDPR playbook. Your support team needs to be briefed on these requests and how they should respond.

I have a difficult time believing that any "controller" complaining about this is properly prepared to respond to GDPR access requests.... Which is kind of the whole point of the study, no?

View on HN

Your message implies an organization that has at least two engineers and at least two support people. Many of the site owners who were seriously bothered by it seem to have been one person operations running non-commercial personal sites and it never occurred to them that they needed to look into what if any obligations they might have under laws like GDPR and CCPA.

Maybe the default index.html that gets created when you first set up a site should include a notice that if your site is going to be public facing you might be subject to laws like GDPR and CCPA and link to resources you can use to figure out if you are in fact subject to them.

Same for whatever blogging software is common on these sites. I'd guess that they usually include a sample entry so you can verify that your installation is working? If so, include privacy law information in the sample entry.

For professional organizations this is a non issue. For a small operator it can be both their first request, and their first request from someone who is just shooting off random requests to parties that they know have zero data on them, which is an abuse of the process. To add vaguely worded legal threats to that is way beyond where it should have gone. Anyway, the researcher seems to have realized this by now.

The study methodology apparently involved a sample of high-traffic websites from https://tranco-list.eu. I have a hard time believing that the operators did not have to deal with such requests before. I always add the 30 day statements in my GDPR requests, mostly to make sure the support people set a calendar reminder to reply before the date. The next step if no reply is received is to complain to the data privacy watchdog in the country of the website operator or in your country if the website is operated outside EU (though I always begin with an email follow-up). Nobody would go to court after 30 days of a GDPR request without going through the govt data protection agency first. And to be clear, only requests are entitled to a 30-day reply and the email said that no formal request is being filed at the time [1].

But yes, that was clearly human research and the IRB should have grilled the PI about that.

[1]: https://christine.website/blog/princeton-study-2021-12-17

Edit: as you can see from the replies below, not only the study ethics is questionable but also the technical details about its methodology.

I've read more than one response from people saying they are operating their website all by themselves and they definitely did not seem to be high traffic.

As I've said elsewhere, I'm on that list and I'm nowhere near what I'd consider a "high-traffic website". The site in question is a zero-revenue personal project, is is several orders of magnitude too small by any metric to be subject to the CCPA (which is the law the letter I got referred to).

They absolutely did not survey only large websites.

You better believe it, because I got one of these emails about my personal site and I had never had to deal with it before.

I also received an email for a domain that I had absolutely nothing to do with. It seems their system identified my email's domain (i.e. not my email!) because it was in the last link on that domain's homepage – something that a human would have spotted easily.

My org is prepared to failover to our disaster recovery site, but that doesn't mean we want to or that it isn't work.

The fact that this came to you via a ticketing system might mean you’re a little out of touch with the personal blog operators this freaked out.

I wonder how many people getting upset by this are also advocating for fire alarm drills to be removed because "they waste precious resources"?

Emotion definitely overriding people's logic abilities here.

If a researcher starts pulling fire alarms of random buildings, they will face felony charges.

That's not how fire alarm drills work though. That's how fire alarms work.

In this situation, the "researcher" is the person conducting the drills. Which are way more frequent than these emails.

Without the permission of the property owner, conducting a fire alarm drill is no different than pulling the fire alarm.

>That's not how fire alarm drills work though.

You seem to be stuck on this part still.

Stuck on what?

It's your analogy, that the research in question is similar to fire alarm drills, that the researcher is analogous to the people who conduct the drill. I'm merely pointing out, that one cannot randomly conduct fire alarm drills on properties that don't belong to them.

The researchers don't own the websites, and they certainly don't own the internet. What entitles them to conduct the "drill"?

Reply on news.ycombinator.com