> Does anyone know if GDPR (or similar law in the future) will actually force HN and other sites that don't have this feature, to remove accounts, at least EU ones, upon request?
As far as I know, the GDPR is more of a clarification (along with some explicit guidelines for fines), than it is new legislation - so hn and similar sites would already be in breach, if they didn't allow the deletion of all profile data. I'm not certain that having to email someone at hn to do it, would be in breach of current data protection regulation. It may be that not clearly stating: "to get a record of all data hn has stored on you, make correction or delete all data - please email (...)" will be in breach of GDPR.
But afaik hn does no business in the EU - so it's not clear what sanctions would be applicable.
It's different for companies that does business in the EU / EEC.
No. EU laws/regulations dont't apply outside its jurisdiction. GPDR will affect Facebook, Google etc. just because they are operating in EU market[0]:
"This won't apply to every U.S. business — just the ones that are knowingly, and actively, conducting business in the EU. In this vein, EU courts have the discretionary ability to determine if a U.S. company was purposely collecting EU resident data and subverting GDPR compliance."
I respectfully disagree. As you can see at [0], quote, "as [the GDPR] applies to all companies processing the personal data of data subjects residing in the Union, regardless of the company’s location [...] Non-Eu businesses processing the data of EU citizens will also have to appoint a representative in the EU."
edit: This means it applies to EU citizens regardless of where the processor is located and to non-EU citizens if they are currently in the EU
Yes, but I'm sure this will only be valid for big enough companies (read serving millions of EU citizens) as it's subjective what "processing the data of EU citizens" actually means. It's not realistic to expect every minor mom&pop eshop or minor online service worldwide to appoint a representative in the EU. Furthermore, enforcing these rules will highly depend on international relations as it's outside of EU jurisdiction and it can only reach non-EU companies by collaboration and signing treaties with other governments, so this means USA and maybe Canada, but I highly doubt to see companies from China or Russia etc. to be held accountable.
Well, only time will tell, I just relayed what I've heard from people much more knowledgeable in this area than me. How I understand this is that if you serve many enough EU citizens, please be kind, open a branch in EU or at least send a representative, because you are de-facto doing business here. Mainly this is to avoid situations where, for example Facebook, closes its EU offices and pretend to have no EU presence (and no need to abide EU regulations) despite hundreds of millions EU citizens use their services.
Sure, it technically applies - but I doubt it will have any effect. Compare it to hacking across border where there is no extradition. At least until some form of GDPR is rolled into international trade treaties.
I very much doubt GDPR penalties will be levied at individuals - even when a business entity is wholly controlled by an individual. Blocking of criminal services does seem probable in extreme cases - but so far most of Europe has been pretty lenient wrt outright censorship as far as I know. Filtering certain child pornografi content being an exception.
On a side note, the cp filter is scary - as the infrastructure implies the existence of censorship infrastructure ready for abuse in the event of a power shift.
As far as I know, the GDPR is more of a clarification (along with some explicit guidelines for fines), than it is new legislation - so hn and similar sites would already be in breach, if they didn't allow the deletion of all profile data. I'm not certain that having to email someone at hn to do it, would be in breach of current data protection regulation. It may be that not clearly stating: "to get a record of all data hn has stored on you, make correction or delete all data - please email (...)" will be in breach of GDPR.
But afaik hn does no business in the EU - so it's not clear what sanctions would be applicable.
It's different for companies that does business in the EU / EEC.