Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I am not a lawyer, but my full-time work involves reviewing codebases for GDPR and CCPA compliance.

I do not believe this strategy will achieve what OP is hoping.

In response to a deletion request, Reddit instead seeks to anonymize the data. Anonymous data is not personal data, so anonymous data is not covered by GDPR.

If you submit a GDPR deletion request, they will in this way wriggle into a position where they claim GDPR does not apply.

When Reddit (or most any other website) soft-deletes an account, they simply obfuscate the user's identifiers such as username and IP address. They argue that this is sufficient to make the mass of remaining data anonymous, and therefore not covered by any privacy law.

This is an extremely common position for websites. However, it requires that the remaining data truly be anonymous. For Reddit, this is absurd, as the free-form content of the website allows any amount of identifying information to be uploaded. Reddit simply cannot guarantee that identities cannot be deduced from what remains.

I believe this is fundamentally in violation of GDPR, but I am not a GDPR regulator with the power of enforcement.

This requires a legal appeal to the regulatory bodies.



Usually companies would rather delete uploaded content / text to avoid the chance of the user having disclosed private information through that content which will remain if simply "anonymized" because the account holder's PII is disconnected from the content. The liability is high enough to warrant deleting the content.


I agree, "legitimate" companies usually want to comply and to do right by their users. That's why I get hired.

But currently the entire online analytics and advertising industries are hanging by this thread.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: