> If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty.

> It would destroy the usefulness of a forum.

Couldn't you just anonymize their posts, for instance by updating their username to something like "Deleted User"? Wouldn't you be fine as long as there wasn't anything left to link them to their real identity?

What if some used quoted another user without the quote function? Or took a snippet from a user as forum signature?

Those are easily handled but still if you are a hobbist it’s just too much hassle.

I asked something similar in the Instapaper story:

A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A?

I didn't get an answer there. It is basically the same scenario of one user referencing another.

Yeah that's an interesting question about the line for GDPR and the right to be forgotten. If a user themself posts text onto a forum, I wouldn't consider that private information. If it's not private info, I wouldn't think they should be able to legally request it be deleted. That would be almost like an editor of a wikipedia article asking that it be removed. I wonder how GDPR applies.

Actually text posts can be used to personally identify users, given you have access to enough written words from this person to build a profile of their writing style.

It's been used to track and identify people. IIRC it's also been used in attempts to impersonate people.

So one can argue that text posts are personal data that can be used to identify them, but I suppose this is the kind of thing that is up to the court to decide.

Gdpr doesn’t have a clause for voluntary, required or accidental sharing.

If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind.

> If a user publishes on your forum he has disabilities, congratulations, under gdpr you just leaked user personal data of the worst kind.

I'm really not sure what people think they're gaining from posting these wildly inaccurate GDPR comments.

I agree, the amount of FUD and fearmongering related to GDPR is quite impressive, even here on HN. It seems people who don't like GDPR are trying their best to make it look diabolical as if this would make it go away.

No, you do what's necessary to fullfill the service you provide to the user: they wanted to publish a forum post, you store and publish the submitted data as is necessary to offer this. That's neither a leak nor forbidden.

> But if they then said that I need to remove _all of their posts_, that's really shitty.

Why do you think GDPR forces forum owners to delete posts? Which bit of GDPR do you think introduces this requirement?

In order to reply to your questions, the mark would have to study the GDPR one way or the other to answer them.

That by itself is way too much hassle.

Well, yes, if someone has no idea what's in GDPR they're probably going to be more fearful of all the bullshit being spread about it.

Well the burden of proof lies on the person who makes the claim. otherwise it's an unsubtantiated claim that can be discarded without evidence.

It would certainly be interesting to quantify how much money has been spent just trying to understand it

How does GDPR affect people in other countries with no interest in doing business in Europe? If I host a forum in the US and you ask me to remove your posts and I tell you where to stick it, what legal consequences might I face?

Erm, asking for a friend.

If you aren't in the Union, it applies to you if either [1]:

(a) you are processing data of data subjects who are in the union related to the offering of goods or services to such data subjects, or

(b) you are processing data of data subjects who are in the union related to monitoring of their behavior as far as their behavior takes place within the Union.

If you can avoid both of these, then I believe you can pretty much ignore GDPR.

If you have "no interest in doing business in Europe", it should be easy to avoid falling under (a). Recital 23 [2] discusses what it means to be "related to the offering of goods or services" to data subjects in the Union.

It means that you have to envisage offering services to such people. The mere accessibility of your website to EU people, or having an email or other contact details in the EU, is insufficient to show such intent. If you offer your website in EU languages that are not generally used in your non-EU country, accept EU currencies, mention your EU customers on your site, and things like that, will strongly suggest you are offering them goods and services.

What monitoring of their behavior means is discussed in Recital 24 [3]. It basically means tracking a person for profiling or analyzing or predicting their personal preferences, behaviors and attitudes.

Most sites selling things to end users probably don't need to do any such behavioral monitoring. If you do, just do a geoip check and exclude EU IPs. If you aren't trying to do business in Europe you probably want to do that anyway, because EU visitors are just noise in your data.

[1] https://gdpr-info.eu/art-3-gdpr/

[2] https://gdpr-info.eu/recitals/no-23/

[3] https://gdpr-info.eu/recitals/no-24/

geoip based blocking is wrong. An American customer can be travelling in Europe and be blocked while any EU citizen can use a proxy or VPN to workaround your geoip block.

If you can live with infuriating a small portion of your customers while have a protection that can be circumvented in a matter of seconds then geoip block is what you want, otherwise ...

As wan23 already noted, the purpose of the geoip block is to help establish that you are not offering goods or services to data subjects in the Union, in order to not fall under GDPR territorial jurisdiction (see Article 3).

Yes, that will also catch some of your existing US customers when they travel to Europe. However, you may actually want that, because the GDPR does not talk about EU citizens. It talks about data subjects "in the Union".

I haven't seen anything about what makes someone who is physically present in the EU count as being "in the Union" for GDPR purposes. One who wants to be cautious might want to count anyone physically in the EU as being "in the Union" for GDPR purposes until there is definitive guidance otherwise.

It's an efficient way to protect yourself from the regulation. You don't need to prevent Europeans from using your site, you just need to be able to say reasonably that you don't intend to operate in the EU.

Maybe you do business with someone that does have a footprint in the EU? They can put the screws to them I guess.

I imagine visiting an EU member would be unwise as well.

As much as I dislike Donald Trump, I am willing to hold my nose here and suggest encouraging the Trump Administration to go full MAGA and direct Congress to pass laws explicitly stating that no foreign judgements or fines may be enforced on US citizens.

boom.

1000% increase in foreigners moving/ starting technology companies in the US.

seriously tho. great idea.

Yes, and then they just wait until you show up on their soil (say, on vacation) and arrest you then.

Remember Assange? He's fine as long as he stays in the embassy, but step into the back alley for a smoke and he's off to the hoosegow.

I think we understand where you're coming from, but as written this is incredibly ignorant. You're essentially rejecting all international law (copyright, patent, tax, etc).

I guess posts are considered 'User Generated Content' which I think falls under the directive.

Does that also mean then that quoted content counts? What if another user merely copies/pastes text someone said into their own reply (like you have to do on HN)?

From what I've seen of the policies in other forums: If they posted actual personal information, admins will edit it out on request, but in general they don't consider posts that don't contain anything identifying personal information and will keep them.

In that sense, is hn not GDPR compliant?

Are their posts personal data though ?