News for hackers. Stuff that matters.

A comment on Data portability, the forgotten right of GDPR. Parent comment

Re:Data portability, the forgotten right of GDPR by capableweb on Tuesday May 25, 2021 @09:17AM (#27276416)
Ah well, I guess "easy" is relative. I'm sure if you send them one email, they'll confirm it with you once within a month and then delete the data.

Compare that to Coinbase, which has forms, buttons and seems it's mostly an automated process instead of manual email, but I've tried getting Coinbase to delete my account + data for over 6 months now to no avail, multiple emails back and forward where they confirm the deletion, say it's in progress, I email back after a month and they ask me to confirm the deletion again.

So even with a button, doesn't mean the process is easy, and there is also a lot more to consider than just how you initially the request.

[ Parent | on HN ]
Re:Data portability, the forgotten right of GDPR by hungryforcodes on Tuesday May 25, 2021 @09:29AM (#27276523)
Mind you, Coinbase probably has an obligation to keep your data for x number of years for both tax and auditing purposes.
[ Parent | on HN ]
Re:Data portability, the forgotten right of GDPR by Buttons840 on Tuesday May 25, 2021 @10:49AM (#27277523)
This is such a grey area. Do emails others sent to me belong to them? Do my HN comments make the entire conversation partially mine? If one of my comments is "well said", and the parent deletes their comment, is not my comment diminished? What do we do about quotes? Etc.
[ Parent | on HN ]
Re:Data portability, the forgotten right of GDPR by capableweb on Tuesday May 25, 2021 @11:04AM (#27277747)
Solved problem already: Hash the username + a salt and change that everywhere. Every comment is from a unique author + the comment body is still there + all the replies are still there but, author name has been removed.
[ Parent | on HN ]
Re:Data portability, the forgotten right of GDPR by Buttons840 on Tuesday May 25, 2021 @11:56AM (#27278466)
That's a decent solution. But I think simply replacing the usernames with [deleted] is better. It leaves the comment but detaches the user and breaks the link between all the users comments.
[ Parent | on HN ]
Re:Data portability, the forgotten right of GDPR by capableweb on Tuesday May 25, 2021 @11:58AM (#27278500)
It becomes very hard to track conversations with N+2 users though, if more than one has the [deleted] username. Hence the hashing to get a unique [deleted] username for each user.
[ Parent | on HN ]
Re:Data portability, the forgotten right of GDPR by kuschku on Tuesday May 25, 2021 @12:57PM (#27279299)
That's not legal either. If the comment body contains personal information anywhere, GDPR also applies to it.
[ Parent | on HN ]
Re:Data portability, the forgotten right of GDPR by newswasboring on Tuesday May 25, 2021 @09:26AM (#27276490)
I have sent such emails for a previous account, the emails were ignored.
[ Parent | on HN ]