News for hackers. Stuff that matters.

A comment on Instead of deleting account, NYT appends ‘1000’ to username and email address. Parent comment

Re:Instead of deleting account, NYT appends ‘1000’ to userna... by mesozoic on Tuesday April 28, 2020 @12:21PM (#23008551)
Pretty sure that breaches GDPR and maybe CCPA. Maybe they can get away with anonomyzing the data but that doesn't sound like what is being done.
[ Parent | on HN ]
Re:Instead of deleting account, NYT appends ‘1000’ to userna... by true_religion on Tuesday April 28, 2020 @12:55PM (#23008934)
Sure, but a local paper like the New York Times is hardly subject to the laws of the EU, so GDPR doesn’t apply.
[ Parent | on HN ]
Re:Instead of deleting account, NYT appends ‘1000’ to userna... by 6gvONxR4sf7o on Tuesday April 28, 2020 @01:11PM (#23009164)
It does if they take subscribers from the EU (or california) and apply this process to them. It's incredibly straightforward. If you do business in some jurisdiction, then that business is subject to the jurisdiction's laws.
[ Parent | on HN ]
Re:Instead of deleting account, NYT appends ‘1000’ to userna... by mopsi on Tuesday April 28, 2020 @01:32PM (#23009490)
Not only do they take subscribers, they actively target the European market. When I open nytimes.com, a pop-up offers 0,50€/week digital access.
[ Parent | on HN ]
Re:Instead of deleting account, NYT appends ‘1000’ to userna... by true_religion on Wednesday April 29, 2020 @02:14AM (#23015985)
Hmm, it seems I was wrong then. I had thought that they didn’t localize to any EU countries, but I guess they have more of a global market than the other papers I am more familiar with.
[ Parent | on HN ]
Re:Instead of deleting account, NYT appends ‘1000’ to userna... by wtfishackernews on Tuesday April 28, 2020 @01:11PM (#23009163)
If their website is accessible from the EU then they are subject to GDPR.
[ Parent | on HN ]
Re:Instead of deleting account, NYT appends ‘1000’ to userna... by kube-system on Tuesday April 28, 2020 @04:15PM (#23011367)
The EU says that GDPR applies globally.

Some violators might successfully keep their assets out of the reach of EU enforcement, but that's going to be really tough to do for any large business with global operations.

[ Parent | on HN ]