Hacker News Reader

Comment by romwell | Hacker News Reader

I think the solution is "the right to fucking delete your account forver".

Google keeping "limbo" accounts is dystopian, and seems like a GDPR violation to me.

I'm all for grace and forgiveness, but it seems excessive to require businesses to delete all records of people who defrauded them.

If a liquor store had caught me with a fake ID, I wouldn't consider it dystopian if they put my name on a list and kept it in the back.

I guess it would make sense for them to keep it until you have the actual legal age.

It wouldn’t make sense to refuse to sell you liquor when you’re in your 80s though.

At least the GPDR should allow you to correct the age. I don't think it has any provisions that say that if you entered incorrect data yourself, you waive your right to have data corrected.

They'd be required to correct the age, but they wouldn't be required to delete the "this person defrauded us by giving a false age" flag/note on your internal profile.

I think they’d have a hard time justifying the legitimate interest assessment to keep that data forever.

I agree with your statement though, but the GDPR issue is the retention time, not a DSAR issue.

"I have a legitimate interest in never doing business with someone who defrauded me" seems like a reasonably easy argument to make.

It’s an easy argument, but that doesn’t make it correct. Within law “crimes” have a statue of limitations and almost never infinite long punishment. A strong argument is needed to override someones rights for an unlimited time like that.

If you work in the EU, have a chat with your DPO/Privacy team cause I bet they would actually find this an interesting conversation too.

As part of our privacy team, I'm glad it's someone else's argument to have in court someday.

The problem is the company is in a privileged position. And there have to be limits. If not, they could stretch the definition of "defrauded me" to whatever they want, for example including discrimination of any kind.

This is a hard edge case in my opinion, because unless you unregister that email everywhere you used it, someone else will gain access to all your old accounts which would leak potentially much worse things than a record saying this email is not available anymore.

How would deleting the account in question help anyone, though? Or are you saying that after deleting, they would then be allowed to re-register after a ban? Isn't that just isomorphic to demanding Free Ban Evasion for All?

>How would deleting the account in question help anyone, though? Or are you saying that after deleting, they would then be allowed to re-register after a ban?

The problem described in the post is that the user has a shadow, inaccessible disabled account that they can't do anything about, forever, and that's a problem.

>Isn't that just isomorphic to demanding Free Ban Evasion for All?

I think it would be isomorphic to Google implementing verification on account creation, thereby preventing this scenario from happening in the first place.

> I think it would be isomorphic to Google implementing verification on account creation, thereby preventing this scenario from happening in the first place.

They did, though. They straight up asked the kid if he was 18, and he lied and said "yes". I don't know what you want here, you want Google to... protect it's customers from their own fraud? Does any other industry do that?

(full disclosure: I work there, but on open source firmware and know nothing about Adsense)

It's not a GDPR violation.

https://gdpr.eu/recital-47-overriding-legitimate-interest/

> The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.

"legitimate" is doing a lot of work here.

I wonder if you could argue that it isn't "strictly necessary" after a certain point though. Does ToS abuse by minors in this way really predict fraud 15 years later? If the SNR of a signal decays over time, at a certain point do the interests of liberty exceed the interests of preventing fraud?

I have absolutely no idea and am not a lawyer, it just seems to me that the word "strictly" is meant to indicate that it isn't pixie dust companies can sprinkle on any piece of information as they choose. The rest of the language here seems to stress that there has to be some sort of test which demonstrates that the interests of the controller overrides the interest of the data subject.

Reply on news.ycombinator.com