### About Community Tracking and helping #redditmigration to Kbin and the Fediverse. Say hello to the decentralized and open future. To see latest reeddit blackout info, see here: https://reddark.untone.uk/
Strongly suggest overriding all comments and posts (using something like PowerDeleteSuite) before submitting a GDPR request though. Replace it with “use kbin/lemmy” or similar.
Not sure whether it will work out but I am planning to do that before API is gone (assume ~28th of June or something).
I did this and my comments are back.
They'd probably recover the original content, even though it is illegal for them to do so.
Don't worry, their IPO will surely be a success after part of the community leaves + possible GDPR fines.
If you can prove that the data you're asking to have deleted is or contains PII, I'm sure they'll comply to the letter of the law. Outside of that, all content submitted to Reddit belongs to Reddit, Conde Nast, Advance Media, and all subsidiaries.
Surely this is wrong? If the content I posted is not deleted and it still shows as being made from my account, it traces back to me, so it should be deleted if I requested so. In addition to this, would you apply the same logic to private messages? With or without your name or username, if you send a message to someone and cancel or delete it, no one should be able to recover it unless you consent to it.
Let's go more in depth now. According to the UK's Data Protection Act 2018 (GDPR) and EU's Regulation (EU) 2016/679 (General Data Protection Regulation):
Examples of Personal Data (excluding the most obvious ones): (here and here)
- race
- ethnic background
- political opinions
- religious beliefs
- trade union membership
- genetics
- biometrics (where used for identification)
- health
- sex life or orientation
Processing Meaning: (here)
Processing covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
Examples of processing include:
posting/putting a photo of a person on a website;
With this in mind, you can no longer only be identified by your username (in case it says "Deleted"), you could potentially be identified by your post's content (and post history). If consent is withdrawn and you wish that the company stops processing your data, the company must comply (here).
With the heat Reddit is taking, and probably the wave of complaints that's about to happen, I'm eager to see what's going to be the regulator's response.
I believe it's less straightforward than that. Under GDPR, consent can be withdrawn, you can't give an irrevokable consent.
See https://kbin.social/m/RedditMigration/t/34112/Updated-Reddit-is-quietly-restoring-deleted-AND-overwritten-posts-and#entry-comment-161522 and https://kbin.social/m/RedditMigration/t/34112/Updated-Reddit-is-quietly-restoring-deleted-AND-overwritten-posts-and#entry-comment-149886
It doesnt' belong to Reddit. You give them a license (transferrable and non-revocable) to use the content. But in the EU that is superceded by the GDPR.
Any hope for Canadians? Not sure if using GDPR or CCPA would work in that case.
Reddit's Privacy Policy and User Agreement apply to you either way, so I'd assume you'd be able to make a request based on that. Due to the EU's GDPR regulations, most companies make their policies GDPR-compliant, meaning fewer variations, less work, and better consumer protections.