I've always wondered how someone who is locked out of a service like Facebook is supposed to delete their content.
Let's say that I'm a resident of some location with better-than-average digital privacy rights. If I can't log in to Facebook, how can I get my stuff deleted?
How do people handle this in places like the EU (or maybe California)?
Written requests to their privacy officer. datarequests@support.facebook.com
It can be a bit of a pain; https://ruben.verborgh.org/facebook/emails/2019-02-15-dpo/
HN isn't much better. I've emailed them asking for my data to be removed, as is my right as an EU citizen and dang simply refused saying it wouldn't be fair to other users. As if that overrides the law.
https://oag.ca.gov/privacy/ccpa
> Right to delete: You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information).
One of my clients willingly applies GDPR to everyone, regardless of jurisdiction. If you want your data, you can get it. If you want your stuff deleted, you can do so. I think this is the ethical approach.
> Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market.
Those US newspaper sites you can't access: well, you can access them via archive.org.
> Being accessible from the EU doesn't make your business subject to EU law. The EU doesn't claim universal jurisdiction.
Collecting data related to EU individuals does make you subject to the specific GDPR law though, unless I'm mistaken.
Nope, GDPR attaches regardless of whether you market in the EU/to EU residents, as long as you provide goods or services to people in the EU you're beholden to their rules.
Theoretically, a company that only offers services to US residents (mortgage/banking/legal) could still be beholden to GDPR, since their cardholders might access their website (i.e. be provided services) while in Europe, though as far as I know it's never been tested in court.
The EU has full jurisdiction within the EU, and zero without. The EU has no ability to demand action or inaction from an entity in the United States. They can ask all they want but it's just that - a request.
Please read this in good faith: If you want your data gone, why do you keep sending more (posting)? Is it about retention time?
On the other hand, I agree with GP. It's surprising that you cannot delete an account. That HN stay "readable" without the [deleted] is clearly secondary to the possibility of having an account be deleteable. Imagine if I were part of an at-risk group.
I think the part that bothers me most is that you seem to have firmly decided the EU regulators aren't real human beings trying to solve a legitimate problem in a way you disagree with. That'd be too respectful and humanizing. They're pure evil?
If it is PII then EU laws like GDPR apply, but if it is posts more generally then they are not covered, and it would be unfair to people who have responded to them and those reading those responses later (sans context, if your post were removed). The right to be forgotten covers information about you, not information by you (with an edge-case that if somehow your words in a post unambiguously identify you, that post falls into the first category as well as the second so is covered).