aceca

joined 1 year ago
[–] aceca@kbin.social 1 points 1 year ago* (last edited 1 year ago)

How exactly do you trivially remove all references to the physical, physiological, genetic, mental, economic, cultural or social identity of the person posting?

This is the bar you'd have to clear to ensure someone's comment history were anonymized per GDPR, miss a single one of these factors and your anonymous data is now reversible and thus infringing.

[–] aceca@kbin.social 4 points 1 year ago* (last edited 1 year ago)

Usernames are online identifiers:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-are-identifiers-and-related-factors/

A non-exhaustive list is included in Recital 30

An individual’s social media ‘handle’ or username, which may seem anonymous or nonsensical, is still sufficient to identify them as it uniquely identifies that individual. The username is personal data if it distinguishes one individual from another regardless of whether it is possible to link the ‘online’ identity with a ‘real world’ named individual.

[–] aceca@kbin.social 2 points 1 year ago (3 children)

The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier or one of several special characteristics

By definition commenting reddit users are covered, even if they haven't posted anything otherwise identifying -- but most have either way.

[–] aceca@kbin.social 1 points 1 year ago* (last edited 1 year ago) (2 children)

If a user is commenting they have an online identifier and are thus covered. If a user has ever referenced their relationship status, location or any physical descriptor they are covered. The GDPR -- it applies.

[–] aceca@kbin.social 1 points 1 year ago* (last edited 1 year ago)

You're all over this thread saying this, what exactly do you think "right to erasure" means?

From gdpr.info:

Since the definition includes “any information,” one must assume that the term “personal data” should be as broadly interpreted as possible.

Here's a short list of information thought not to be personal which has later been found personal:

  • Start end/times at work
  • Break times
  • Cultural id markers
  • Written answers to exam questions
  • Mental illness
  • Any physical descriptor
  • online identifiers (ie your reddit username which may be shared with other sites to identify you)
  • and plenty more

The idea that redditors do not have personal information lingering in their comments is absurd, GDPR 100% applies.