Hacker News Reader

Comment by fabian2k | Hacker News Reader

Where does the idea come from that not allowing users to delete content is against the law/GPDR?

You have the right to ask for deletion of personal information they store, and even that has certain limits. You don't have the right to force the company to delete content unless they granted you that right via the licence somehow.

Whether this is a good or bad idea for a company to do is a different question. But I don't see a legal issue here like the linked post claims.

View on HN

> You don't have the right to force the company to delete content [relating to you]

In the EU, you definitely do.

No, check GDPR Article 4 (1): personal data means any information relating to an identified or identifiable person.

The content of a post is not personal data (in general) but the things like user name etc are. The content is not relating to an identifiable person (in general) while the user name is.

Shakespeare's poems are not personal data.

Depends on the content - not many people out there are directly doxxing themselves but indirectly? Maybe.

From my post history on Reddit, you'd know where I live, my age, gender, job, relationship status and a good amount about places I've been and my interests. There are already websites that collate that info from a profile to give a summary of the user. Under GDPR, that quite possibly adds up to personal data relating to an identifiable person.

And when this is combined with Facebook/Google/Apple/Microsoft shadow profiles, it's an almost certain guarantee that information is linked with your name, DOB, credit info, and tax ID number.

Not disagreeing with you or parent in general, that a post (or as you point out a history of posts) can be personal data.

What I'm saying is, in general it isn't. If you sign up to platform XYZ and make a post, in general, the content of the post is not personal data. It certainly can be. But by default it isn't. That's a misconception I want to dispel.

Yep I agree, if you posted on a specific subreddit this is already personal information about yourself. There is no way they are not violating GDPR if they deny a request to delete (but I guess they can block direct deletion in bad faith and tell you to submit a direct request).

I'm not saying the content of a post can not be personal data. I'm saying it is not by default.

The words "Hello world" posted on any subreddit is not personal data. In this case the company could simply delete the information relating to you such as user name, IP etc.

The content you post is not, in general, personal data. It certainly can be.

That's kind of funny, because "Hello World" gives a strong indication of your profession and interests. Not enough on its own to be PII, but a useful data point.

The moment they post it publicly, it is no longer considered personal private content

That’s not the definition of personal data.

I can post my name publicly, but it’s still considered personal data. It doesn’t magically become a free for all just because it’s out there.

No, personal data in GDPR is much wider than American PII definition.

Maybe so, but stuff you post on public forums is not PII, neither by the American nor the European definition.

Something similar happens with HIPAA that people don’t understand.

Personal Health Information is only applicable in a specific setting (a covered entity). You telling your boss/friend/form about your health information does not make it PHI. You willingly disclosed that information.m, it loses its protected status.

GDPR has no such exclusion criteria. The definition is astonishingly simple:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’).

Note the weight of the word “any” here.

Well, within reason. You need a policy that allows this to happen, but, for example, it can't just reach into 3 months' worth of PIT database backups. But you can say "we will delete your user now, and your data will roll out of our backups after 3 months." That's reasonable while still delivering the main objective: companies can't keep your (identifiable) data forever.

No, you're thinking of the right to force the company to delete content that you yourself, and your interactions with their system (or the system's observations of you) were causal to generating within their systems.

For a clear example of the difference: I don't have the right under GDPR to tell Apple to reach into everyone else's iCloud address books to delete my phone number out of them. Neither I nor Apple put my phone number into other people's address books; those other people manually entered that info into their address books themselves. Which makes that their data, that they created — which just happens to reference me (and which is held in trust by a third party.)

If GDPR worked the way you're imagining, then someone deleting their WhatsApp account would require WhatsApp to tell my phone to delete my locally-saved WhatsApp chat-logs of conversations with that person.

Okay, and what are Reddit comments besides UGC that users directly generated?

What if that content includes personal data about me? My hopes, dreams, preferences, plans, goals and political opinions?

That’s an interesting question in principle (even if there are some clear legal directives). You can try to reconstruct a user profile even just from a list of commonly visited subreddits. It can help gauge age, location, personal interests and political convictions. And if you have access to the content of the messages, well, even doxing may be possible.

What if it does? I am not under the impression that those fall under PII/GDPR (IANAL), so if you post that stuff online to a site you do not control, it certainly has the potential to remain there.

And that is the heart of one the problems with reddit or any other site that encourages people to post everything under the sun. You are giving up control of what then happens with your content.

GDPR protects any data which can be tied to an identifiable person. So, if reddit posts are attached to my username, and my username can ultimately be tied back to me (see: my username is my name), then reddit cannot disallow deletion of these posts. There may be a workaround by no longer identifying them with a specific user, but this would have to be done on the back end, as simply changing who the displayed user is would still leave the data intact.

I'm not sure about the specifics of GDPR, but it could be argued that even your style of writing personally identifies you. There are even projects that do just that to find alternate reddit accounts of people [1].

[1] https://github.com/jabraunlin/reddit-user-id

GDPR requires deleting personal data upon request unless required to be held by law.

Your Reddit posts are not personal data. Okay, you can probably get specific ones removed that way where you explicitly include personal data. But this doesn't mean that you have a right to delete all content you write anywhere.

Your Reddit posts absolutely can have personally identifying information and therefore are subject to GDPR.

But we're talking about mass deletion of all your content here. If you specifically mention your real name or address or something like that in a post, it's a different situation.

I think the fact that all of your posts are tagged with your userid means they can all be traced back to you, making them all personal information. It's not hard to see how, for example, some employer might get ahold of your Reddit userid and crawl through your post history, looking for any opinion of yours that they don't like.

There is almost 14 years of posts and comments linked to my account. While I'm always careful to not reveal any personal information online, if you mine through 14 years of reddit content I posted I guarantee you that there would be enough little nuggets of information there to figure out my actual identity.

You are sharing a lot more than you think you do. Here is a good example of how much can me determined from a single short video: https://www.linkedin.com/posts/gabrielfriedlander_youve-got-...

It's a weird interaction with Section 230 if Reddit can say "these posts are not ours, they are the posters" and yet the poster cannot edit/delete them.

Of course, HN itself kills your edit window after a certain time limit, so there is some legal way of doing it, I assume.

HN also has a prominent FAQ entry about this where they say they will help you with deletion requests for personal information if you email them.

Section 230 does not talk about ownership.

A freight company is generally not liable for contraband shipped without its knowledge. That does not mean that all shipments become the property of the freight company. Same thing.

A freight company that took your freight, refused to give it back, and acted like it was now theirs would appear to own it.

If Reddit says "your content is yours but you cannot delete it" they're in a bit of a cake-and-eat-it-too scenario.

I'm entirely sure it's legal (as other forums/HN/etc do it too) but I'm not sure it's right.

> If Reddit says "your content is yours but you cannot delete it" they're in a bit of a cake-and-eat-it-too scenario.

Yes, but the user is also in a cake-and-eat-it-to scenario: they get to own the content and have it distributed for free.

Both sides of this come from the perpetual non-exclusive license that posting to Reddit or Twitter or anywhere confers. "Ownership" is too reductive a concept for IP, which is why the section 230 thing is a non sequitur.

It is. See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

Only if your personal posts are important for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing.

No, you are confusing, say, a post, with its content. The content of a post does (in general) not relate to an identifiable person.

This may legally be the case, but it is worth noting that there are various tools out there to try and find posts written by the same person under different names. They use word frequencies, I think.

So, this seems like a case of the law not 100% matching reality. Sometimes the EU adjusts their laws to keep up with reality, I think? (The idea of trying to make sensible laws is pretty foreign to me, but then I’m an American.

If your user account can be related to your person it’s most definitely personal data by European standards.

[0]European Commission defines personal data as: >Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

Thus, anything you wrote on any site, if it is not anonymised and still linked or could be traced to your account is a personal data.

And even when it is anonymised: >Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR.

[0] - https://commission.europa.eu/law/law-topic/data-protection/r...

We have a ‘right to be forgotten’ law

If you were to post on another public website "My name is X, and my Reddit username is Y", would your anonymous Reddit posts now be considered personal data?

I suppose this would constitute indirect identification of a data subject under GDPR?

Reply on news.ycombinator.com