Hacker News Reader

Hacker News

Comment by michaelteter | Hacker News Reader

Full thread

michaelteter

And are you prepared to respond to GDPR and other jurisdiction requirements of data collection and management?

View on HN

My hope is that, since it's opt-in, and people are publicly publishing this stuff, It'd be alright. Dunno.

You will get haters and armchair lawyers no matter what you do. Ignore the trolls.

Aren't you jumping the gun a little bit? While it's a valid question, it's very premature.

It's not premature; it's something to consider whenever sharing people's personal data on the internet.

The GDPR does not apply "in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity" [1].

However, that does not extend to generally sharing the information on the internet [2] as that's no longer purely personal.

[1] https://gdpr-text.com/read/recital-18/

[2] https://law.stackexchange.com/questions/92229/what-does-hous...

How does the fact that the user opts-in for the service by manually adding the tag to their profile so that information they personally added could be shared get considered by the GDPR?

Not sure and IANAL but the GDPR text is a bit weird on that. Article 9 has section e) which says that information 'manifestly made public' relating to 'special categories' is excluded.

What's weird is there seems to be no such exclusion for personal information which does not relate to special categories.

Having this 'opt-in' certainly seems to tick the box for consent.

However, if reproducing information from a publicly available bio would fall foul of GDPR requirements, then I think there are bigger fish to fry than a hobby project made by a guy who at least seems to trying to respect people's preferences.

Although I wrote "it's something to consider", from what I can see the developer has already considered this sufficiently for the scale of the project.

No action is needed if OP doesn’t store unnecessary info or use spyware

Usual note that IANAL, but looks like this service is opt-in, and only relists data which is already public on a user's HN profile.

If a user removes the reference from their bio, then the user's profile will be essentially inaccessible through the service (although technically the cached version would still be on the server. Adding a check to delete the file which matches the user's hashed ID here[0] would take care of profile deletions on subsequent accesses.

Failing all that, a user could request deletion and OP could delete the user's file manually.

There's nothing that seems overly onerous to implement to be (at least) GDPR compliant.

[0]https://github.com/padolsey/at.hn/blob/d4ca6702c558edf736652...

Reply on news.ycombinator.com