News for hackers. Stuff that matters.
Re:Data portability, the forgotten right of GDPR by capableweb on Tuesday May 25, 2021 @09:10AM (#27276344)
Have you tried emailing [email protected] and it got denied? Or what you mean there is no easy way to request the data deletion? AFAIK they don't scrub the comments but if you request it, your username will be replaced with [deleted] for all your comments.
Re:Data portability, the forgotten right of GDPR by kjakm on Tuesday May 25, 2021 @09:28AM (#27276511)
I remember trying that with an old account a few years ago (suggesting your solution of just hiding the username) and was denied. Maybe things have changed since then though.
Re:Data portability, the forgotten right of GDPR by murphy1312 on Tuesday May 25, 2021 @09:13AM (#27276367)
that is by no means an easy way.

easy would be a button on the profile page for example.

Re:Data portability, the forgotten right of GDPR by capableweb on Tuesday May 25, 2021 @09:17AM (#27276416)
Ah well, I guess "easy" is relative. I'm sure if you send them one email, they'll confirm it with you once within a month and then delete the data.

Compare that to Coinbase, which has forms, buttons and seems it's mostly an automated process instead of manual email, but I've tried getting Coinbase to delete my account + data for over 6 months now to no avail, multiple emails back and forward where they confirm the deletion, say it's in progress, I email back after a month and they ask me to confirm the deletion again.

So even with a button, doesn't mean the process is easy, and there is also a lot more to consider than just how you initially the request.

Re:Data portability, the forgotten right of GDPR by hungryforcodes on Tuesday May 25, 2021 @09:29AM (#27276523)
Mind you, Coinbase probably has an obligation to keep your data for x number of years for both tax and auditing purposes.
Re:Data portability, the forgotten right of GDPR by Buttons840 on Tuesday May 25, 2021 @10:49AM (#27277523)
This is such a grey area. Do emails others sent to me belong to them? Do my HN comments make the entire conversation partially mine? If one of my comments is "well said", and the parent deletes their comment, is not my comment diminished? What do we do about quotes? Etc.
Re:Data portability, the forgotten right of GDPR by capableweb on Tuesday May 25, 2021 @11:04AM (#27277747)
Solved problem already: Hash the username + a salt and change that everywhere. Every comment is from a unique author + the comment body is still there + all the replies are still there but, author name has been removed.
Re:Data portability, the forgotten right of GDPR by Buttons840 on Tuesday May 25, 2021 @11:56AM (#27278466)
That's a decent solution. But I think simply replacing the usernames with [deleted] is better. It leaves the comment but detaches the user and breaks the link between all the users comments.
Re:Data portability, the forgotten right of GDPR by capableweb on Tuesday May 25, 2021 @11:58AM (#27278500)
It becomes very hard to track conversations with N+2 users though, if more than one has the [deleted] username. Hence the hashing to get a unique [deleted] username for each user.
Re:Data portability, the forgotten right of GDPR by kuschku on Tuesday May 25, 2021 @12:57PM (#27279299)
That's not legal either. If the comment body contains personal information anywhere, GDPR also applies to it.
Re:Data portability, the forgotten right of GDPR by newswasboring on Tuesday May 25, 2021 @09:26AM (#27276490)
I have sent such emails for a previous account, the emails were ignored.