Someone mentioned invoking GDPR’s right to be forgotten. Although comments are not strictly personal information, it could still work. I think I’ll try it soon.
I think you should definitely try, but I don’t think it’ll work. According to this stackexchange question they could argue that deleting your comments would break the cohesiveness of the discussion and make the available information incomplete.
Art.17, 3a states that the right to be forgotten is not applicable if processing of the data is required to exercise freedom of information. So I don’t think posts or comments are affected by the GDPR as long as they don’t contain any information that would identify a user
Reddits privacy policy itself states that you can use GDPR or California’s CCPA and has instructions for invoking it (basically just sending them an email).
https://www.reddit.com/policies/privacy-policy
You‘re right, you can use the GDPR to delete personal data. But again, I don‘t think posts and comment are considered personal data and that they would not have to be removed since they are essential to understanding the discussion as a whole
The GDPR was never intended to be able to destroy information, just to protect the privacy of users. So as long as there‘s no information that could identify a user in their posts/comments (which no one should make publicly available anyways) then Reddit is under no obligation to delete the content you generated. They only have to disassociate it from your account, which they do by displaying the username as „deleted“
Right, but how would they handle the case where personally identifiable information could be in the text itself?
Someone could tell a very descriptive story with enough detail that you can figure out who it is, or maybe someone who knows enough of the story in real life could figure out exactly who it was that made the comment?
For example, someone makes a comment with a long story and in there they include something like, “I’m Karen and I work at the restaurant where that [insert some major news story here…]”. People make mistakes all the time and they might want to quickly delete that information.
Not only that, if you look at enough of someone’s comment history you can start figuring out a lot of information about that person. In one comment they might mention the city they live in, in another they might mention the name of the business they work at, somewhere else you figure out their gender, in some cases they may even post a picture of themselves.
Edit: fixed formatting where some text was hidden.
Hmm yeah that’s true… So really the question is who decides what “sufficiently anonymized” actually means. Or what counts as personal data and what does not. Probably only a court can answer these questions since the GDPR is not very precise in that regard
I guess the best way to find out is to request deletion of all data including comments and posts, and if they don’t comply then take them to court or file a complaint with your national Data Protection Authority
Someone mentioned invoking GDPR’s right to be forgotten. Although comments are not strictly personal information, it could still work. I think I’ll try it soon.
I don’t think they can just restore all comments and bypass the GDPR, that would be insane. It’s a very serious law in Europe.
I think you should definitely try, but I don’t think it’ll work. According to this stackexchange question they could argue that deleting your comments would break the cohesiveness of the discussion and make the available information incomplete.
Art.17, 3a states that the right to be forgotten is not applicable if processing of the data is required to exercise freedom of information. So I don’t think posts or comments are affected by the GDPR as long as they don’t contain any information that would identify a user
Reddits privacy policy itself states that you can use GDPR or California’s CCPA and has instructions for invoking it (basically just sending them an email). https://www.reddit.com/policies/privacy-policy
You‘re right, you can use the GDPR to delete personal data. But again, I don‘t think posts and comment are considered personal data and that they would not have to be removed since they are essential to understanding the discussion as a whole
The GDPR was never intended to be able to destroy information, just to protect the privacy of users. So as long as there‘s no information that could identify a user in their posts/comments (which no one should make publicly available anyways) then Reddit is under no obligation to delete the content you generated. They only have to disassociate it from your account, which they do by displaying the username as „deleted“
Right, but how would they handle the case where personally identifiable information could be in the text itself?
Someone could tell a very descriptive story with enough detail that you can figure out who it is, or maybe someone who knows enough of the story in real life could figure out exactly who it was that made the comment?
For example, someone makes a comment with a long story and in there they include something like, “I’m Karen and I work at the restaurant where that [insert some major news story here…]”. People make mistakes all the time and they might want to quickly delete that information.
Not only that, if you look at enough of someone’s comment history you can start figuring out a lot of information about that person. In one comment they might mention the city they live in, in another they might mention the name of the business they work at, somewhere else you figure out their gender, in some cases they may even post a picture of themselves.
Edit: fixed formatting where some text was hidden.
Hmm yeah that’s true… So really the question is who decides what “sufficiently anonymized” actually means. Or what counts as personal data and what does not. Probably only a court can answer these questions since the GDPR is not very precise in that regard
I guess the best way to find out is to request deletion of all data including comments and posts, and if they don’t comply then take them to court or file a complaint with your national Data Protection Authority