Hacker News Reader

It is a violation of the GDPR if this data wasn't returned to people who asked for their data. I can almost guarantee it was not...

Someone might want to refer Google to one of the data protection authorities here...

View on HN

Nah also just the principle of data minimisation - if there is no good reason to save it (this long) then it shouldn't be saved. A DPA would probably have Google pay for that if it would come that far.

It is also a violation of the GDPR (Art. 25) if Google cannot prove they implemented the "appropriate technical and organisational measures" to protect personal information, both at the time of designing that system, and at the time of actually exploiting that system with live traffic.

Reply on news.ycombinator.com