Hacker News new | ask | show | jobs
by agotterer 3013 days ago
I'm not a lawyer either, but have been going through the GDPR process at my job. It doesn't matter if you operate or are established in the EU. If you have EU visitors/users they gain the protections of the GDPR and you have to comply.

GDPR affects any org/site that collects personal or sensitive data. Amongst many others IP address and email address are considered PII under GDPR. We use IP address for some high level geolocation data and decided to drop the last octet so it's not tied directly to an individual visitor. The specialists we spoke with had concerns about free form input fields because anyone can write anything they want in them.

In the case of hackernews it seems like email address, ip, profiles, and comments could contain personally identifiable data. I'm also curious how HN similar sites are supposed to comply with GDPR removal requests when it can destroy the usability and functionality of the site.
2 comments
DoreenMichele 3013 days ago
In the case of hackernews it seems like email address, ip, profiles, and comments could contain personally identifiable data.

You aren't required to put anything in the profile. If you choose to put information in the profile, you can remove it yourself at any time you so choose.

link
gregmac 3008 days ago
The GDPR also requires personal information be removed from backups, or at least after a backup is restored (eg: restoring from backup does not negate the original Right To Be Forgotten request).

So while you can remove some of that info yourself, I don't think that can be seen as fulfilling GDPR requirements.

Disclaimer: I am neither a lawyer nor GDPR expert.

link
brightball 3013 days ago
I'm very interested to see how such requests would actually work...mainly because I'm curious to see what actual authority the EU has to enforce its laws outside of its borders.

I understand it applying to companies that are doing business in Europe but beyond that...?

link
ryanlol 3013 days ago
There's a plenty of measures the EU could take within it's jurisdiction to enforce it's laws around the world.

It might suck if the EU started blocking payments to you.

link